beefy[.]airdropsalert[.]onl

The domain beefy.airdropsalert.onl was observed targeting the Google brand through a crypto‑drain scam. Registration data shows the domain was created on 18 October 2025 via Dynadot LLC. DNS resolution points to 142.250.186.132, an address owned by AS15169 Google LLC in the United States, and the authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, and the HTTP page title returned is simply “Google”, matching the declared impersonation of the Google brand. Google Safe Browsing has flagged the site for social engineering, and the same classification appears in its own threat feed.

The site was listed on one public blocklist and was actively blocked by the PhishDestroy sinkhole. Gridinsoft assigned a trust score of 0 out of 100, indicating a lack of credibility. VirusTotal analysis recorded 15 detections out of 95 scanned security engines, confirming malicious intent. The infrastructure appears to have been taken offline at the time of reporting, but the combination of a newly registered domain, use of a legitimate Google IP range, and multiple security vendor detections suggests a deliberate attempt to exploit brand trust for cryptocurrency fraud.

Uncertainty remains regarding the exact payload or phishing page content because the site is no longer reachable and no SSL/TLS handshake was observed. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same domain or similar sub‑domains, and consider adding the associated IP address to watchlists despite its legitimate ownership, as abuse of trusted cloud resources is a known tactic. Ongoing surveillance of Dynadot‑registered domains that resolve to Google‑owned IP blocks is recommended to catch future impersonation attempts early.