polkadot[.]airdropalerts[.]life

Analysis of polkadot.airdropalerts.life indicates that the domain is currently offline but historical data reveal a pattern typical of brand‑impersonation campaigns targeting Google users with a fake airdrop lure. The domain resolves to the IP address 216.58.206.68, which belongs to AS15169 Google LLC and is geolocated in Germany. Hosting the malicious site on a legitimate Google IP is a common tactic to gain user trust and evade simple IP‑based filters. The DNS configuration shows no resolvable nameserver entries (NS_NOT_FOUND), suggesting the domain may have been deliberately withdrawn or that the authoritative nameserver records were removed after takedown. Registration was performed through Cloudflare, Inc., a provider often used for its privacy and rapid deployment features.

The site’s HTTP response presented a page title of “Google,” reinforcing the impersonation claim. No TLS certificate was observed, meaning the site did not offer HTTPS encryption, which is inconsistent with the legitimate Google web presence and may serve as an additional detection cue. Threat intelligence feeds flag the domain on a single blocklist and PhishDestroy has listed it as blocked, confirming that at least one security community has taken remedial action. VirusTotal analysis shows that 13 of 95 scanning engines marked the domain as malicious, indicating a moderate consensus of risk. Gridinsoft assigned a trust score of 0 out of 100, effectively classifying the domain as completely untrusted.

The documented scam type is a “Fake Airdrop,” a social‑engineering vector that promises cryptocurrency distribution in exchange for personal credentials or wallet information. While the offline status limits immediate active threat, the infrastructure patterns—use of a high‑reputation IP, lack of SSL, obscure DNS, and rapid takedown—suggest a short‑lived operation designed to harvest credentials before removal.