sym[.]airsdropsalerts[.]click

sym.airsdropsalerts.click was observed targeting the Google brand through a confirmed brand impersonation campaign. The domain was registered on 7 November 2025 via Dynadot LLC and resolves to IP 142.250.176.196, an address owned by Google LLC (AS15169) in the United States. No TLS certificate was presented, indicating the site served only HTTP content. The page title returned by the server is “Google”, matching the advertised brand target.

The domain is listed on a single security blocklist and has been blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, confirming a lack of legitimacy. VirusTotal analysis shows that 14 of 95 scanning engines flagged the domain, reinforcing the malicious classification. Nameserver delegation points to Cloudflare infrastructure (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com).

The scam type is recorded as Brand Impersonation, and the site is currently offline, as indicated by the status field. The combination of a recent registration date, absence of SSL, low trust score, and multiple vendor detections suggests the domain was used in a short‑lived phishing operation aimed at harvesting Google credentials or luring users to a malicious payload. Defenders should add the domain to blocklists at DNS and proxy layers, monitor for any re‑use of the same nameservers or Cloudflare account, and review traffic to the associated IP for signs of other abuse. Ongoing vigilance is recommended because the underlying IP belongs to a legitimate provider, which can be leveraged by adversaries to mask malicious activity.