wlfi[.]airdropsalert[.]app

This domain, wlfi.airdropsalert.app, was observed resolving to the IPv4 address 142.250.185.196, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. Despite the legitimate hosting attribution, the domain is flagged by 16 of 95 security vendors on VirusTotal, receives a zero‑point trust rating from Gridinsoft, and appears on a single public blocklist. The domain was registered through Cloudflare, Inc., but its authoritative nameservers could not be retrieved (NS_NOT_FOUND). No TLS certificate is deployed, and an HTTP request returns a page whose title is simply “Google”, matching the declared brand target.

The site is categorized as a crypto‑scam and has been listed by PhishDestroy as a blocked resource. As of the report date the domain is taken offline, and no further HTTP content is available for analysis. Analysis indicates that the actor leveraged a Google‑owned IP range to lend credibility to a fraudulent Google impersonation, likely to deceive victims into trusting a crypto‑related lure. The lack of SSL, missing nameserver records, and the abrupt offline status suggest a short‑lived infrastructure typical of opportunistic scams.

Defenders should immediately add wlfi.airdropsalert.app to URL filtering and DNS blocklists, monitor traffic to the associated IP address for any residual connections, and consider sinkholing the domain to prevent future reuse. Continuous threat‑intel feeds should be consulted for any re‑registration attempts, and endpoint protection solutions should be updated with the observed VirusTotal detection signatures. Given the low trust score and multiple vendor detections, the domain should be treated as high confidence malicious, and any related phishing or crypto‑scam campaigns should be investigated.