defiapp[.]airdropalerts[.]icu

This domain, defiapp.airdropalerts.icu, was taken offline as of the report date (23 July 2026). It was registered through Dynadot LLC on 14 October 2025 and uses the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The domain resolves to the IP address 142.250.185.228, which belongs to AS15169 owned by Google LLC and is located in the United States. No TLS certificate is presented; the site served HTTP without encryption.

The page title returned by the server is the literal string “Google”, matching the targeted brand. Google Safe Browsing lists the domain under the “social engineering” category, and the Gridinsoft trust score is 0 out of 100, indicating a complete lack of trust. VirusTotal records show that 14 of 95 scanned security vendors flagged the domain as malicious, and it appears on at least one external blocklist, with PhishDestroy confirming it as blocked. The intelligence classifies the activity as a fake airdrop designed to impersonate Google, aligning with a brand‑impersonation campaign.

While the site is currently offline, the infrastructure details—including the use of a Google‑owned IP address and Cloudflare DNS—suggest that the operators may be leveraging legitimate hosting to increase credibility. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection attempts, and add the IP address to threat‑intel feeds. Additional scrutiny of outbound traffic to the associated IP range is advised, and any user reports of unsolicited airdrop communications claiming to originate from Google should be correlated with this indicator. Because the domain lacks TLS and serves a generic title, any future re‑hosting is likely to repeat the same indicators, so detection rules that match the domain, its IP, and the associated Safe Browsing flag should be maintained.