airdropsalerts[.]onl

Analysis of airdropsalerts.onl, which was taken offline prior to this assessment, shows multiple indicators of a brand‑impersonation campaign targeting Google users with a crypto‑scam narrative. The domain was registered on 13 November 2025 through Dynadot LLC and is hosted on Cloudflare infrastructure, using the nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution directs the domain to IP address 142.251.35.164, an address owned by AS15169 Google LLC in the United States, and the TLS certificate presented is issued by Google Trust Services under the WE1 label, further reinforcing the appearance of legitimacy. The web server supports HTTP/3, and the page title returned during probing is simply "Google," matching the declared brand target.

The site is classified as a crypto scam, and four of ninety‑five VirusTotal scanners have flagged it as malicious, indicating partial detection by some vendors. Reputation metrics are poor, with a Gridinsoft trust score of 0 / 100 and inclusion on a single security blocklist, specifically PhishDestroy. These signals collectively demonstrate deliberate brand impersonation and fraudulent intent.

Uncertainty remains regarding the specific payload delivered to victims, as no content analysis or landing‑page screenshot is available; the absence of additional blocklist listings suggests limited exposure at the time of takedown. Defenders should continue to block the domain at network perimeter filters, add the domain and its IP address to threat‑intel feeds, and monitor for any re‑registration attempts or related domains using the same nameservers or Cloudflare configuration. Ongoing vigilance is recommended, especially for email gateways and browser security solutions that reference Google brand protection lists, to prevent future exploitation of similar impersonation tactics.