fil[.]airdropsalert[.]onl

Analysis of fil.airdropsalert.onl shows a high‑risk brand‑impersonation campaign targeting Google users. The domain resolves to 142.250.185.100, an address owned by Google LLC (AS15169) in the United States, yet registration is handled through Cloudflare, Inc., which masks the true registrant. No SSL certificate is presented, indicating the site does not support HTTPS. The page title returned by the server is "Google," directly matching the advertised brand target and the declared scam type of a crypto‑related scheme. Detection data reveal that 14 of 95 security vendors on VirusTotal flagged the domain, and Google Safe Browsing categorises it as social engineering.

It appears on a single external blocklist and is actively blocked by the PhishDestroy service. A Gridinsoft trust score of 0 out of 100 further underscores its malicious nature. Nameserver information is not available (NS_NOT_FOUND), limiting deeper DNS‑level attribution. The domain is currently taken offline, though the underlying infrastructure (the IP address) remains reachable and could be re‑used for future campaigns.

Defenders should immediately block fil.airdropsalert.onl at DNS and proxy layers, add the associated IP to network‑level deny lists, and monitor Cloudflare registrar activity for any re‑registration attempts. Continuous re‑scanning with VirusTotal and similar aggregators is advised to capture any changes in vendor verdicts. Because the IP belongs to Google’s network, caution is required to avoid false positives on legitimate Google services; correlation with the specific domain name should be used to isolate the threat. Until further content is observed, the combination of brand impersonation, crypto‑scam labeling, multiple vendor detections, and a zero trust score recommends treating fil.airdropsalert.onl as a confirmed malicious indicator.