mon[.]airsdropsalert[.]lol

The domain mon.airsdropsalert.lol was registered through Dynadot LLC on November 5, 2025 and is currently listed as taken offline. Technical resolution shows the hostname pointing to IP address 142.250.80.36, an address owned by Google LLC (ASN 15169) located in the United States. Leveraging a Google‑owned IP can be a deliberate strategy to increase perceived legitimacy for a brand‑impersonation campaign. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common pattern for fast‑flux or abused hosting services.

No SSL certificate was observed during analysis, indicating the site was served over plain HTTP or that TLS was not configured before the takedown. The page title reported by the scanner is simply "Google," matching the declared brand target and confirming that the attacker intended to masquerade as Google. VirusTotal analysis recorded eight positive detections out of ninety‑five scanned scanners, reflecting modest but notable consensus among security vendors that the domain is malicious. The domain appears on a single public blocklist and has been flagged by PhishDestroy, confirming that at least one anti‑phishing service has taken corrective action.

Because the site is offline, direct content inspection was not possible, leaving the exact phishing payload or credential‑harvesting mechanisms uncertain. Defenders should continue to enforce blocking of the domain at DNS and proxy layers, add the IP address 142.250.80.36 to watchlists for potential future abuse, and monitor for newly registered domains that resolve to Google‑owned address space while presenting brand‑related titles. Ongoing surveillance of Cloudflare‑hosted domains with similar naming patterns is advisable, as the infrastructure choices suggest a reusable template that could reappear under different domain labels.