plume[.]airdropsalert[.]app

The domain plume.airdropsalert.app was observed resolving to the IP address 142.250.186.132, which belongs to AS15169 Google LLC and is geolocated in the United States. Registration data indicates the domain was created on 27 March 2013 and is currently serviced through Cloudflare, Inc., without an accompanying SSL/TLS certificate. The site title returned by the HTTP response is the generic string “Google”, matching the declared brand target of Google and supporting the classification as a brand‑impersonation campaign. Threat intelligence reports label the activity as a crypto‑scam, and VirusTotal analysis shows that 18 of 95 scanned security vendors flagged the domain as malicious.

The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The host is presently offline, limiting immediate interaction, but the infrastructure footprint remains observable through DNS and IP data.

Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor for any re‑appearance of the domain or related sub‑domains. Additional investigation should focus on any associated C2 infrastructure, potential phishing email campaigns referencing the “Google” title, and the possibility of reused Cloudflare‑proxied assets. Until the site is taken down permanently, the recommendation is to maintain the current blocklist entries and to treat any future resolution of the same domain as a high‑confidence indicator of a crypto‑related brand‑impersonation attempt.