compound[.]airdropalerts[.]bond

Analysis of the domain compound.airdropalerts.bond, observed on July 24 2026, indicates an elevated‑risk brand‑impersonation campaign targeting Google users through a fabricated airdrop promise. The domain was registered on 14 October 2025 via Dynadot LLC and resolves to the IP address 142.250.185.100, which belongs to AS15169 operated by Google LLC in the United States. Nameserver records list brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the use of Cloudflare DNS services. No TLS certificate was presented when the host was queried, and the site is currently taken offline, as confirmed by multiple monitoring sources.

Google Safe Browsing has classified the URL as a social‑engineering threat, and two of ninety‑five VirusTotal scanners flagged the domain, reinforcing the suspicion of malicious intent. The page title returned by the HTTP response is simply “Google”, matching the declared brand target. The scam type is identified as a “Fake Airdrop”, a common lure for cryptocurrency‑related phishing, although the content of the page has not been captured for further analysis. The domain appears on one external blocklist and has been specifically blocked by the PhishDestroy service.

Defenders should add compound.airdropalerts.bond to URL filtering and endpoint protection policies, enforce blocking at the DNS layer, and monitor for any resurgence of the domain or similarly structured subdomains. Given the association with a Google‑owned IP range, network‑level alerts for traffic to this address should be reviewed to rule out legitimate Google services. Ongoing intelligence collection should focus on any future re‑registration attempts, changes to the TLS configuration, or new hosting indicators that could signal a revival of the campaign.