klima[.]airdropsalert[.]xyz

On 23 July 2026 analysts examined klima.airdropsalert.xyz, a domain created on 17 October 2025 and registered through Dynadot LLC. The authoritative nameservers listed are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. No TLS certificate was observed, so HTTPS connections would be unavailable. DNS resolution returns the IPv4 address 142.250.185.68, which belongs to AS15169 owned by Google LLC and is geolocated to the United States. The page title returned by the web server is “Google”, matching the declared brand target of Google and classifying the activity as brand impersonation.

VirusTotal reports that 14 of 95 scanned security vendors flagged the domain, suggesting a moderate level of detection across the security community. The domain is currently listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. The overall risk rating is elevated, and the infrastructure appears to have been taken offline at the time of analysis. Evidence confirms the domain’s association with a crypto‑related scam, though the specific payload or victim interaction has not been captured.

Uncertainty remains regarding the exact phishing kit employed, the presence of any malicious redirects, and whether the domain was ever served over HTTPS. Defenders should continue to block the host at the network perimeter, add the domain to URL filtering policies, and monitor for newly registered subdomains under the airdropsalert.xyz zone that reuse the same Cloudflare nameservers. Additional telemetry from endpoint protection products should be correlated with the 14 vendor detections to assess any compromised hosts. Ongoing observation of the AS15169 address space for anomalous traffic patterns is also recommended.