sca[.]airdropsalert[.]onl

The domain sca.airdropsalert.onl was registered through Dynadot LLC on 18 October 2025 and is currently resolved to the IP address 142.250.185.68, which belongs to AS15169 Google LLC in the United States. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but it does not present an SSL/TLS certificate, indicating that any HTTP connection would be unencrypted. The only visible page title is “Google”, and the domain is explicitly listed as impersonating the Google brand. Threat intelligence categorises the activity as a crypto‑scam, and the site has been blocked by the PhishDestroy service. VirusTotal reports that fifteen of ninety‑five scanning engines flagged the domain as malicious, and the domain appears on one additional security blocklist.

Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The site is presently taken offline, and no further content has been captured. Analysis indicates that the infrastructure deliberately leverages a legitimate Google IP range, likely to increase credibility and evade simple IP‑based blocking. The lack of TLS, combined with the brand‑impersonating page title, suggests a low‑effort approach aimed at redirecting victims to a cryptocurrency‑related fraud page.

At present, the exact payload, landing page structure, or phishing kit cannot be confirmed because the service is offline and no screenshots are available. Defenders should continue to block the domain at DNS and HTTP layers, add the IP address to deny lists, and monitor for any re‑hosting attempts that reuse the same nameservers or IP range. Ongoing observation of the registrar Dynadot and the Cloudflare name servers may reveal future re‑registrations. Users should be warned that any unsolicited communication referencing “Google” from this domain is unauthorised and likely part of a crypto‑scam.