dot[.]airdropsalert[.]us

Analysis of dot.airdropsalert.us shows a high‑risk brand‑impersonation infrastructure targeting Google users. The domain was registered on October 18, 2025 through Dynadot LLC and resolves to the IP address 142.251.40.132, which is allocated to AS15169 Google LLC in the United States. The use of a legitimate Google‑owned IP suggests either compromised resources or intentional abuse of trusted address space to increase credibility. The domain is served by the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and no TLS certificate was observed, meaning the site was reachable only over HTTP.

The page title returned by the server is "Google," aligning with the declared brand target and confirming the impersonation intent. Google Safe Browsing has flagged the URL for social engineering, and VirusTotal reports that 12 of 93 security vendors have identified the domain as malicious, reinforcing the suspicion of a phishing or credential‑harvesting campaign. Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of legitimacy. The site was classified as a crypto‑scam and has been blocked by PhishDestroy; it also appears on a single external security blocklist.

Current monitoring indicates the domain is taken offline, but the infrastructure components—particularly the use of a Google‑owned IP and Cloudflare DNS—remain reusable for future campaigns. Defenders should add dot.airdropsalert.us to DNS and URL filtering policies, enforce block‑listing of the associated IP 142.251.40.132 for suspicious traffic, and monitor for re‑registration or new subdomains using the same nameservers. Continuous threat‑intel feeds should be consulted for any resurgence, and incident response teams should be prepared to investigate any user reports referencing the "Google" page title from this domain.