abstract[.]app-airdropalert[.]sbs

The domain abstract.app-airdropalert.sbs was registered on November 10, 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to IP address 142.250.185.164, which belongs to AS15169 Google LLC and is geolocated in the United States. No SSL certificate was observed on the host, indicating that HTTPS was not configured at the time of analysis. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both hosted by Cloudflare.

The page title returned by the server is simply "Google," matching the declared brand target and confirming that the site was intended to impersonate Google. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, with PhishDestroy explicitly listing it as blocked. VirusTotal analysis shows that 14 of 95 scanned security vendors flagged the domain, reinforcing the malicious assessment. The identified scam type is a crypto scam, consistent with the "airdropalert" sub‑domain pattern.

While the infrastructure points to legitimate Google‑owned IP space, the use of that address for an impersonation site suggests abuse of compromised or spoofed resources. Uncertainty remains regarding the exact payload or phishing page content because the site was taken offline before a full content capture could be performed. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the same hostnames or similar sub‑domains, and consider adding the IP address 142.250.185.164 to reputation lists pending further verification. Organizations should educate users about unsolicited crypto‑related messages purporting to originate from Google and enforce strict verification of URLs before any credential or wallet information is entered.