mon[.]airsdropsalert[.]click

The domain mon.airsdropsalert.click is flagged as a brand‑impersonation campaign targeting Google. It was registered on November 05, 2025 through Dynadot LLC and resolves to the IPv6 address 2a00:1450:4001:80f::2004, which belongs to AS15169 Google LLC and is geolocated in Germany. The hosting appears to leverage legitimate Google infrastructure, a technique often used to increase credibility and evade network‑level blocking. No TLS certificate is presented for the site, and the HTTP service is currently offline, indicating that the operator has withdrawn the payload but may reactivate it later.

The page title returned by the server is simply "Google," matching the declared brand target. VirusTotal analysis shows that 14 of 95 security vendors have flagged the domain as malicious, and the domain is listed on at least one security blocklist. It has also been blocked by PhishDestroy. Nameserver records point to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming Cloudflare DNS services are in use.

For defenders, immediate actions should include adding mon.airsdropsalert.click to URL filtering and DNS blocklists, monitoring the associated IPv6 address for any future activity, and reviewing any recent traffic to Google‑related services that may have originated from this address. Continuous observation of Cloudflare name servers for newly created subdomains that resemble the current pattern is advised, as adversaries frequently regenerate similar domains after takedown. Updating endpoint protection signatures to reflect the 14 vendor detections can further reduce exposure. Because the site is offline, there is no active payload to analyze, but the infrastructure choices suggest a persistent threat actor likely to reuse the same hosting resources for subsequent campaigns.