recall[.]airdropsalert[.]biz

Recall.airdropsalert.biz is an active brand‑impersonation infrastructure observed to resolve to the IPv4 address 142.250.181.228. The address belongs to AS15169, Google LLC, and is geolocated in the United States. The domain was registered on 18 October 2025 via Dynadot LLC and uses the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, meaning the site is served over HTTP only.

The sole page currently accessible returns the title “Google”, matching the declared target brand, and the site is classified as a crypto‑scam. VirusTotal analysis shows that 15 of 95 scanned security vendors flagged the domain, indicating a moderate level of detection across independent scanners. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on a single external blocklist. Defensive feeds such as PhishDestroy have already blocked the domain, and its risk level is designated as elevated.

The infrastructure appears to have been taken offline at the time of reporting, but the historical evidence suggests a deliberate attempt to lure victims by exploiting the Google brand and promising cryptocurrency rewards. While the hosting IP is owned by a legitimate cloud provider, the use of a reputable AS does not mitigate the malicious intent, and the lack of SSL further reduces user trust. Analysts should continue to monitor the domain for re‑activation, enforce blocklist entries in network filters, and consider adding the domain to threat‑intelligence feeds that correlate brand‑impersonation with crypto‑scam activity. Additional investigation of any associated URLs, payloads, or phishing emails would be required to fully map the campaign’s scope.