bnc[.]airsdropsalerts[.]lol

This domain, bnc.airsdropsalerts.lol, was identified as part of a credential phishing infrastructure targeting Google users. Registered on February 21, 2026, through Dynadot LLC, the domain resolved to the IP address 172.253.63.105, which is associated with AS15169 (Google LLC) in the United States. The page title was explicitly set to 'Google,' and the domain was classified as a brand impersonation threat with an elevated risk level. Analysis indicates the domain was taken offline by the time of this report, though it remains relevant for historical tracking and defensive measures.

Detection data reveals the domain was flagged by 11 of 93 security vendors on VirusTotal, and it appeared on at least one security blocklist, including PhishDestroy. The SSL certificate was rated WR2, and Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. While the exact content of the phishing page was not analyzed, the available metadata—including the page title and brand target—strongly suggests an attempt to harvest Google credentials. Defenders should treat this domain as confirmed malicious infrastructure.

Historical DNS and WHOIS records should be preserved for forensic purposes, and any residual resolution to the associated IP (172.253.63.105) should be monitored for potential re-emergence. Given the domain's registration details and detection history, organizations may consider proactively blocking it at the network level to prevent accidental exposure. No evidence of additional scam types or secondary payloads was present in the available data.