tia[.]airdropsalert[.]app

Analysis of the domain tia.airdropsalert.app, observed on July 23, 2026, indicates that it was actively used for a crypto‑related scam that impersonates Google. The site presented a page title of "Google", matching the advertised brand target. The domain resolves to the IP address 142.250.185.228, which belongs to the AS15169 Google LLC network in the United States. Despite the IP being owned by Google’s infrastructure, the domain was registered through Cloudflare, Inc., a common front‑end service for malicious actors. No SSL certificate was presented, meaning the site operated without HTTPS protection.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans returned 15 positive detections out of 95 submitted security vendors, confirming that multiple independent scanners flagged the domain. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. The current HTTP status is offline, indicating that the site has been taken down or is otherwise unreachable at the time of analysis.

Nameserver information could not be retrieved (NS_NOT_FOUND). The combination of brand impersonation, lack of encryption, low trust score, and multiple vendor detections classifies the domain as a crypto scam targeting users who trust Google branding. Defensive recommendations include adding the domain and its resolved IP to network‑level deny lists, monitoring Cloudflare‑registered domains that reference Google in their title, and ensuring that endpoint protection solutions are updated to reflect the 15 vendor detections. Continuous observation of the IP range belonging to AS15169 is advised, as malicious actors may leverage legitimate cloud infrastructure to host future impersonation campaigns.