graph[.]airdropalerts[.]bond

Analysis of graph.airdropalerts.bond shows a recently registered domain (created 14 Oct 2025) that leverages a Google brand imprint. The registrar listed is Dynadot LLC and the authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating Cloudflare DNS infrastructure. The domain resolves to the IPv6 address 2607:f8b0:4004:c23::6a, which belongs to AS15169 operated by Google LLC and is geolocated to the United States. No TLS certificate is presented for the host, so HTTPS connections would be rejected or fall back to HTTP. Google Safe Browsing has flagged the site for social engineering, and the same classification appears on a single external security blocklist.

PhishDestroy has taken the domain offline, and the current status is reported as offline, limiting direct observation of the web content. The page title returned from the last known response is simply “Google”, matching the declared brand target. The listed scam type is “Fake Airdrop”, a common technique that promises cryptocurrency distributions to lure credentials. VirusTotal scans show that 2 of 95 antivirus engines flagged the domain, while Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. Because the site is offline, detailed page content cannot be verified at this time.

Given the convergence of brand impersonation, a Google‑related page title, a fake‑airdrop narrative, and multiple independent detections, the domain should be treated as high‑confidence phishing infrastructure. Defenders should add the IPv6 address and the full domain to blocklists, enforce DNS sink‑hole rules for the associated Cloudflare name servers, and monitor for any re‑registration attempts under similar sub‑domains. Continuous re‑scanning of the domain, especially if it returns to an online state, is advised to capture any evolving payloads or credential‑harvesting forms.