wlfi[.]airdropalerts[.]pro

wlfi.airdropalerts.pro was observed hosting a page whose title is simply “Google”. The domain was registered through Dynadot LLC on 27 November 2025 and is currently taken offline. DNS resolution points to 172.217.18.4, an address owned by AS15169 Google LLC located in the United States, and the domain uses Cloudflare’s alexa.ns.cloudflare.com and randall.ns.cloudflare.com nameservers. No TLS certificate was presented, indicating the site was served over plain HTTP.

Reputation services have flagged the domain: six of ninety‑three VirusTotal scanners raised alerts, Gridinsoft assigned a trust score of zero out of one hundred, and the site appears on at least one public blocklist, where it is listed by PhishDestroy. The page title and the “Impersonates: Google” label suggest a brand‑impersonation campaign targeting Google users, while the “Crypto Scam” classification indicates that the underlying motive is likely to lure victims into cryptocurrency‑related fraud. The limited public data does not reveal the exact content of the landing page, the phishing kit employed, or any captured credentials, so the precise attack vector remains uncertain. Defenders should block the domain at the network perimeter, add the associated IP address to deny‑list rules, and monitor DNS queries for the domain and its Cloudflare nameservers.

Because the domain resolves to an IP owned by Google, any legitimate traffic to that address could be disrupted; therefore, remediation actions should be scoped to the specific hostname. Continuous re‑scanning with multi‑engine services is advised to capture any new malicious payloads should the site be re‑hosted. Organizations using Google services should reinforce user awareness about unsolicited requests for crypto payments and verify URLs before entering credentials.