sym[.]airdropsalert[.]app

Analysis of the domain sym.airdropsalert.app, registered through Cloudflare, Inc., reveals infrastructure associated with a crypto scam impersonating Google. The domain resolved to the IP address 142.250.184.196, which is part of AS15169 (Google LLC) and located in the United States. Despite the hosting IP belonging to Google, the domain itself exhibits characteristics consistent with brand impersonation, as indicated by its page title ('Google') and classification as a crypto scam in available threat intelligence. As of July 23, 2026, the domain is offline, though it was previously flagged by one security blocklist (PhishDestroy) and detected by 16 of 95 security vendors on VirusTotal.

The absence of an SSL certificate further aligns with common phishing infrastructure patterns. Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk classification. Defenders should treat this domain as part of a broader campaign targeting users through fraudulent crypto-related offers, likely leveraging Google's brand to enhance credibility.

While the domain is currently inactive, historical resolution data and detection metrics suggest it was operational long enough to pose a threat. Organizations are advised to block the domain at the DNS level and monitor for related infrastructure, particularly domains registered via Cloudflare with similar naming conventions or impersonation themes. Additional scrutiny of AS15169-hosted domains may also be warranted to identify potential abuse of Google's IP space for malicious purposes.