mole[.]airsdropsalert[.]lol

The domain mole.airsdropsalert.lol was observed targeting Google users. The site presented a page title of "Google", indicating an attempt to masquerade as a Google service. The domain resolves to 172.253.62.104, an address owned by AS15169 Google LLC and geolocated in the United States. Registration data shows the domain was created on 5 November 2025 and is registered through Dynadot LLC. Nameserver records list brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the use of Cloudflare DNS infrastructure.

No TLS certificate was presented when the host was queried, meaning the site was served over plain HTTP only. The domain has been taken offline as of the report date, and PhishDestroy has already blocked it. VirusTotal analysis returned detections from seven of ninety‑five scanning engines, and the domain appears on a single external blocklist. The combination of a Google‑related page title, the use of a Google‑owned IP address, and the lack of encryption are consistent with a brand‑impersonation campaign designed to harvest credentials or deliver malicious payloads.

However, the site’s exact content, login flow, and any additional payloads have not been captured, leaving the full scope of the threat uncertain. Defenders should continue to monitor the domain’s DNS and IP reputation, add the IP address and domain to local deny lists, and ensure that users are educated about the risks of entering credentials on non‑HTTPS sites that mimic Google services. Because the domain is currently offline, any active exploitation is likely halted, but the infrastructure may be reused for future campaigns, so ongoing vigilance is recommended.