sail[.]airdropalerts[.]pro

Analysis of sail.airdropalerts.pro shows a domain that was created on November 27, 2025 and is currently taken offline. The domain registers through Dynadot LLC and uses Cloudflare name servers alexa.ns.cloudflare.com and randall.ns.cloudflare.com. It resolves to IP address 172.253.63.105, which belongs to AS15169 Google LLC located in the United States. Despite the IP being owned by Google, the domain is listed as a crypto‑related scam that impersonates Google, as indicated by the page title "Google" and the explicit brand target of Google.

No TLS certificate is presented, meaning the site would serve traffic over plain HTTP if it were reachable. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. VirusTotal scans flag the domain on 12 of 93 security vendors, and it appears on one external blocklist, suggesting that multiple security products have identified it as malicious. PhishDestroy has already added the domain to its block list.

The combination of a brand‑impersonation page title, lack of encryption, low trust score, and multiple vendor detections collectively points to a deliberate attempt to lure victims into a cryptocurrency scam. Uncertainty remains around the exact payload or landing page content because the site is offline and no additional malware analysis is available. Defenders should continue to block the domain and the associated IP at perimeter controls, monitor for any resurrection attempts, and enrich detection rules with the observed name‑server and registrar attributes. Further investigation is advised if the domain reappears, focusing on TLS provisioning, content changes, and any new vendor detections.