zrc[.]airdropalerts[.]pro

Analysis of zrc.airdropalerts.pro indicates that the domain was active for a brief period before being taken offline. The site was registered on November 27, 2025 through Dynadot LLC and resolved to the IP address 142.250.185.164, which belongs to AS15169 Google LLC and is geolocated in the United States. No TLS certificate was observed, meaning the site served content over plain HTTP only. The page title returned by the server was "Google," matching the declared brand target of Google and confirming the intent to impersonate the search giant.

The infrastructure was hosted on Cloudflare nameservers (alexa.ns.cloudflare.com and randall.ns.cloudflare.com), a common choice for fast‑flux and abuse operations. Detection data show that seven of ninety‑three VirusTotal scanners flagged the domain, and it appears on a single external blocklist. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The campaign was classified as a crypto scam, suggesting that victims were likely prompted to send cryptocurrency under the guise of a Google‑related offer.

The site was blocked by the PhishDestroy service, which contributed to its offline status at the time of reporting. While the exact payload and user‑facing content have not been captured, the combination of brand impersonation, lack of encryption, low trust score, and multiple vendor detections provides strong evidence of a fraudulent operation. Defenders should continue to monitor the domain and associated IP for any re‑registration attempts, update URL filtering and threat‑intel feeds to include the observed IP and nameserver pair, and enforce strict TLS‑only policies to reduce exposure to similar plain‑HTTP impersonation attempts.