eul[.]airdropalert[.]us

Analysis of the domain eul.airdropalert.us indicates a high-risk phishing campaign impersonating Google, classified as a crypto scam. The domain was registered on October 19, 2025, through Dynadot LLC and currently resolves to the IP address 172.253.63.104, which is geolocated in the United States under AS15169 (Google LLC). Despite the IP being associated with Google's infrastructure, this does not confirm legitimacy, as threat actors may exploit hosting services for malicious purposes. The domain lacks an SSL certificate, increasing the risk of unencrypted data transmission. As of the report date, the domain is offline, though it remains flagged by one security blocklist (PhishDestroy) and is classified under social engineering by Google Safe Browsing.

Detection data from VirusTotal shows that 11 out of 93 security vendors have flagged this domain, suggesting moderate consensus on its malicious nature. Gridinsoft assigns a trust score of 0/100, further corroborating its high-risk status. The page title, 'Google,' aligns with the reported brand impersonation, though the exact content and mechanisms of the scam remain unconfirmed due to the domain's offline status. Nameservers are hosted on Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common practice among both legitimate and malicious domains.

Defenders should treat this domain as compromised and maintain its blocklist status. Monitoring for reactivation or similar domains registered through the same registrar (Dynadot LLC) is recommended. Given the crypto scam classification, organizations handling cryptocurrency transactions or Google-branded services should prioritize user education and endpoint protection to mitigate potential exposure. No additional infrastructure or kit details are available at this time.