euler[.]airdropalert[.]us

The domain euler.airdropalert.us was registered on 19 October 2025 through Dynadot LLC. It resolves to the IPv4 address 192.178.155.147, which is geolocated in the United States and belongs to ASN 15169, the network owned by Google LLC. The domain is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate was observed, indicating that HTTPS was not enabled. The only visible HTML element is the page title “Google”, matching the declared brand target. The site was classified as a crypto‑related scam that impersonates Google, and Google Safe Browsing flagged it for social engineering. Independent blocklist PhishDestroy has already taken the domain offline, and the domain appears on a single security blocklist.

Reputation scoring from Gridinsoft assigned a zero‑point trust rating. VirusTotal analysis recorded 11 detections out of 93 scanned scanners, confirming malicious intent. Current status is offline, but the infrastructure—particularly the IP address and Cloudflare DNS configuration—remains reusable for future campaigns. Defenders should continue to monitor the 192.178.155.147 address for any re‑activation, add the domain and its IP to internal block lists, and enforce strict outbound filtering for traffic to unknown subdomains of airdropalert.us.

Because the registrar is Dynadot, threat‑intel feeds that track newly created domains from this registrar should be watched for similar patterns. The lack of SSL and the use of a generic page title suggest a low‑effort impersonation kit, yet the detection count indicates that the payload may have involved cryptocurrency theft. Until the domain is fully retired, security teams should treat any emails referencing “airdropalert” or “Google” with heightened suspicion and apply standard brand‑impersonation mitigation controls.