t[.]airdropalerts[.]pro

Analysis of t.airdropalerts.pro, reported on 23 July 2026, indicates the domain is being used for brand impersonation targeting Google users in a crypto‑scam campaign. The domain was registered on 27 November 2025 through Dynadot LLC and resolves to the IP address 142.251.163.147, which belongs to AS15169 Google LLC in the United States. Despite the hosting belonging to Google’s infrastructure, the site presented no TLS certificate, leaving the connection unencrypted. The page title returned by the server is “Google”, matching the declared brand target and reinforcing the impersonation intent.

Nameserver records point to alexa.ns.cloudflare.com and randall.ns.cloudflare.com, typical of Cloudflare‑managed domains. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal scans recorded 7 detections out of 93 security vendors, and the domain is listed on a single security blocklist, confirming that multiple independent sources have identified it as malicious. PhishDestroy has taken the domain offline, and current status checks report the site as taken offline.

The combination of a brand‑matching page title, lack of encryption, low trust score, and multiple vendor detections suggests a high likelihood that the domain was employed to lure victims into a crypto‑related fraud, possibly by presenting counterfeit Google‑branded content to harvest credentials or payments. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any resurgence of the domain or related infrastructure. Additional investigation of traffic logs for connections to 142.251.163.147 may reveal compromised clients or further malicious activity. Because the site is offline, real‑time content analysis is not possible, but the existing indicators provide sufficient evidence for inclusion in threat‑intel feeds and for proactive defensive measures.