polkadot[.]airsdropsalerts[.]sbs

The domain polkadot.airsdropsalerts.sbs was observed resolving to the IP address 142.250.185.228, which belongs to AS15169 Google LLC and is geolocated in the United States. Registration data show the domain was created on 7 November 2025 and was registered through Dynadot LLC. The authoritative nameservers listed are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No SSL certificate was presented for the site, meaning the connection was unencrypted. The page title returned by the server was "Google," and the threat classification supplied labels the activity as a brand impersonation targeting Google.

VirusTotal scans recorded 11 detections out of 93 security vendors, and the domain has been added to a single security blocklist. Independent mitigation services, including PhishDestroy, have already blocked the domain. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. As of the report date, 23 July 2026, the domain is listed as offline, but historical activity suggests it was used to lure victims by masquerading as a Google resource.

Defenders should continue to monitor DNS queries for the domain and its associated IP, enforce blocklisting of the IP and domain at network perimeters, and consider adding the domain to internal threat intelligence feeds. Because the site employed Cloudflare DNS without TLS, future investigations should verify whether any subsequent re‑registration attempts appear on other Cloudflare‑hosted zones. The lack of an SSL certificate and the low trust score reinforce the recommendation to treat any traffic to this host as malicious.