arb[.]airdropalert[.]us

arb.airdropalert.us was registered through Dynadot on 19 Oct 2025. The domain resolves to 192.178.155.147, an address owned by AS15169 Google LLC in the United States, which suggests the attacker leveraged infrastructure associated with the legitimate Google network to increase credibility. No TLS certificate is presented, indicating the site was served over plain HTTP. The page title returned is simply “Google”, matching the declared brand target and confirming a brand‑impersonation intent. Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has already blocked the host.

VirusTotal reports that 11 of 93 scanned security vendors flagged the domain, reinforcing the malicious assessment. Cloudflare’s name servers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com) are in use, a common choice for fast‑changing malicious sites. Gridinsoft assigns a trust score of 0 / 100 and the domain appears on one external blocklist, further indicating low reputation. The listed scam type is “Crypto Scam”, although the exact payload or lure has not been observed because the site is currently offline.

Uncertainty remains around the specific phishing kit or any active C2 infrastructure, as no sample pages or redirects have been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor the underlying IP for any future reuse, and add the host to internal threat intel feeds. Additional scrutiny of traffic to Cloudflare name servers associated with this domain may reveal related campaigns. Ongoing observation of the IP range owned by AS15169 is recommended, as abuse of legitimate cloud assets is a recurring tactic.