flx[.]airdropsalert[.]us

Analysis of flx.airdropsalert.us, reported offline on 23 July 2026, shows a high‑risk brand‑impersonation campaign that claims to represent Google. The domain was registered through Dynadot LLC on 18 October 2025 and resolves to 172.253.63.106, an address owned by AS15169 Google LLC in the United States. Using an IP range owned by the legitimate target is a known deception technique that can bypass simple IP‑based reputation checks. The site presents no TLS certificate, so any communication would occur over unencrypted HTTP, increasing the likelihood of credential interception or malicious redirection.

Gridinsoft’s trust scoring assigns the domain a score of 0 out of 100, indicating an extremely low confidence in its legitimacy. The page title returned by the server is "Google," directly matching the advertised brand and reinforcing the impersonation intent. The listed scam type is a crypto‑related scam, suggesting that victims may be lured into sending cryptocurrency or providing wallet information. Detection data show that 12 of 93 security vendors on VirusTotal flag the domain as malicious, and it appears on one external blocklist.

Google Safe Browsing flags the site for social engineering, and the anti‑phishing service PhishDestroy has already taken it offline. While the exact content of the page has not been captured, the combination of brand impersonation, lack of encryption, a zero trust score, and multiple vendor detections provides strong evidence of malicious intent. Defenders should add flx.airdropsalert.us to URL filtering and intrusion‑prevention rules, enforce block‑listing of its IP address, and monitor DNS queries for the domain and its Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com). Continuous telemetry collection from endpoint protection solutions is advised to detect any residual payloads that may have been delivered before the takedown.