usual[.]airsdropsalert[.]click

This domain, usual.airsdropsalert.click, was observed hosting a page whose title is exactly "Google". The site is registered through Dynadot LLC and was created on 5 November 2025. Technical resolution shows the domain pointing to IP address 142.250.186.36, which belongs to AS15169 Google LLC and is located in the United States. The domain uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but it does not present an SSL/TLS certificate, resulting in plain HTTP connections. VirusTotal records indicate that 14 of 95 scanned security vendors flagged the domain as malicious.

Independent blocklist monitoring shows the domain listed on a single security blocklist and it is actively blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The site is currently reported as taken offline, limiting real‑time content inspection. The only explicit indicator of intent is the brand impersonation tag, identifying the domain as a Google impersonation campaign.

Because the page title matches the targeted brand and the domain’s infrastructure is tied to a Google‑owned IP range, defenders should treat the domain as a high‑confidence brand‑spoofing vector. Recommended mitigations include adding the domain to network‑level deny lists, updating web‑proxy and DNS filtering policies, and monitoring for any resurgence of the domain or similarly crafted sub‑domains. Analysts should also watch for new registrations that reuse the "airsdropsalert" label or the same Cloudflare name servers, as these may indicate an evolving campaign. At present, no further content details are available, and the offline status prevents deeper forensic analysis.