zrc[.]airdropalerts[.]onl

This domain, zrc.airdropalerts.onl, is flagged as a brand impersonation threat targeting Google, with infrastructure analysis revealing characteristics consistent with a crypto scam. Registered on November 27, 2025, through Dynadot LLC, the domain resolves to the IP address 142.251.12.99, which is geolocated in Singapore under AS15169 (Google LLC). While this IP is associated with a legitimate provider, the domain itself lacks an SSL certificate, a common red flag for phishing infrastructure. Nameservers point to Cloudflare (alexa.ns.cloudflare.com and randall.ns.cloudflare.com), a frequent choice for threat actors seeking anonymity and resilience.

Detection data indicates elevated risk: PhishDestroy has blocked the domain, and Gridinsoft assigns a trust score of 0/100. Nine of 93 security vendors on VirusTotal flagged the domain as malicious, though the absence of additional context limits definitive classification. The domain appears on at least one security blocklist, and its page title, 'Google,' aligns with the reported brand impersonation. As of July 23, 2026, the domain is offline, though this status may change.

Defenders should treat this domain as high-risk infrastructure, particularly for users interacting with crypto-related promotions or airdrops. The lack of SSL, Cloudflare nameservers, and the domain's creation timeline suggest a deliberate setup for fraudulent activity. While the exact content of the site remains unanalyzed, the available evidence—including the scam type classification as a crypto scam—supports blocking or monitoring this domain in enterprise and consumer security tools. Further investigation into associated IPs, registrar actions, and hosting patterns may uncover additional linked infrastructure.