graph[.]airdropsalert[.]app

graph.airdropsalert.app is currently flagged for brand impersonation targeting Google. The site resolved to IP 142.250.185.132, which belongs to the AS15169 Google LLC network located in the United States. Registration information indicates the domain was provisioned through Cloudflare, Inc., but authoritative name server data could not be retrieved (NS_NOT_FOUND). The HTTP response lacked an SSL/TLS certificate, meaning the connection was unencrypted. The sole HTML element observed was the page title “Google”, matching the declared brand target and confirming the impersonation intent.

The domain was classified as a crypto‑scam, and Google Safe Browsing flagged it for social engineering. It appears on a single public blocklist, PhishDestroy, and VirusTotal recorded 16 detections out of 95 scanned engines. Gridinsoft assigned a trust score of 0/100, indicating a malicious reputation. The site has since been taken offline, but the infrastructure components—Cloudflare registration, Google‑owned IP range, and lack of TLS—remain observable.

Uncertainty remains around the underlying payload, hosting platform, and whether additional command‑and‑control infrastructure was used, as no further content or code analysis is available. Defenders should immediately block the domain at perimeter and DNS layers, add it to internal threat intelligence feeds, monitor for re‑registration or similar sub‑domains, and consider sinkholing the associated IP range if feasible. Continuous observation of Cloudflare‑registered domains that resolve to Google‑owned IPs and present brand‑related titles is recommended to catch future impersonation attempts. The combination of brand‑targeted page title, high‑confidence IP ownership, multiple vendor detections, and low trust score supports a high‑risk assessment.