eul[.]airdropsalert[.]app

The domain eul.airdropsalert.app was observed hosting a brand‑impersonation campaign targeting Google. Registration details indicate the domain was created through Cloudflare, Inc., and the domain currently resolves to the IP address 142.250.184.228, which belongs to AS15169 owned by Google LLC in the United States. The page title reported by crawlers is "Google," confirming the intent to mimic the legitimate brand. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports that 15 of 95 security vendors have flagged the domain as malicious.

The site appears on a single security blocklist and has been actively blocked by the PhishDestroy service. Automated trust scoring from Gridinsoft assigns a score of 0 out of 100, indicating a total lack of confidence in the domain's legitimacy. No SSL certificate is present, and the domain’s nameserver records are listed as NS_NOT_FOUND, suggesting that DNS resolution may be unreliable or intentionally obscured.

The domain is presently marked as offline, but historical resolution data confirms it once pointed to a Google‑owned IP, a tactic often used to lend credibility to phishing infrastructure. Defenders should immediately add eul.airdropsalert.app to URL filtering and DNS sinkhole lists, ensure that endpoint protection solutions incorporate the current VirusTotal detection count, and monitor for any resurgence of activity. Continuous observation of Cloudflare‑registered domains targeting Google should be prioritized, as the registrar can obscure the true ownership of malicious infrastructure.