s[.]airdropalerts[.]pro

Analysis of s.airdropalerts.pro indicates it is a brand‑impersonation site targeting Google. The domain was registered on 27 November 2025 through Dynadot LLC and uses Cloudflare name servers (alexa.ns.cloudflare.com, randall.ns.cloudflare.com). DNS resolution points to IP 142.250.184.228, which belongs to AS15169 Google LLC in the United States, a common tactic to lend credibility by hosting the malicious payload on infrastructure owned by the victim brand. No SSL certificate is presented, and the HTTP service is currently offline, consistent with the “taken offline” status reported. The page title returned by the server is “Google”, matching the declared impersonation target.

Threat intelligence sources show the domain is categorized as a crypto scam and has been blocked by the PhishDestroy feed. Gridinsoft assigns a trust score of 0 / 100, indicating extreme suspicion. VirusTotal analysis reports that 7 of 93 scanning engines flagged the domain, reinforcing the malicious assessment. The domain appears on one public blocklist, further confirming its reputation as a threat vector. While the infrastructure details are concrete, content‑level evidence such as the actual landing page or phishing kit is not available because the site is offline.

Consequently, the full scope of the campaign—e.g., whether it attempted to harvest credentials or lure victims into cryptocurrency transactions—remains uncertain. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurrection of the host, and add the associated IP address to deny‑list rules, especially given its association with Google’s own ASN. Additional scrutiny of traffic to Cloudflare‑served subdomains and rapid re‑evaluation if the site returns online are recommended. Organizations using Google services should also educate users about unsolicited airdrop alerts and enforce multi‑factor authentication to mitigate potential credential compromise.