folks[.]airdropalert[.]us

folks.airdropalert.us was observed as a high‑risk brand‑impersonation site targeting Google. The domain was registered through Dynadot LLC on 19 October 2025 and is currently taken offline. DNS resolution points to 142.250.176.196, an address owned by Google LLC (AS15169) located in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. No SSL certificate is presented, meaning the site would have been served over HTTP only.

The page title returned by the server is “Google”, matching the declared brand target. Google Safe Browsing classifies the domain as a social‑engineering threat, and it appears on at least one external blocklist. VirusTotal analysis shows that 11 of 93 scanning engines flagged the domain, and PhishDestroy has already added it to its block list. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The intelligence tags the campaign as a crypto scam, though the exact payload or transaction mechanism has not been disclosed.

Because the domain resolves to infrastructure owned by the legitimate target, attribution based solely on IP is unreliable; however, the combination of a spoofed title, lack of TLS, and multiple security vendor detections confirms malicious intent. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the host, and update URL filtering policies to include the observed hostnames and Cloudflare nameservers. Incident response teams should also flag any outbound connections to the IP address as suspicious, especially if they originate from users attempting to access Google services. Ongoing vigilance is recommended, as the operators may reuse the same registration profile or Cloudflare configuration for future campaigns.