wlfi[.]airdropalerts[.]icu

Analysis of wlfi.airdropalerts.icu shows a brand‑impersonation infrastructure targeting Google users with a fake airdrop narrative. The domain was registered through Dynadot LLC on 14 October 2025 and is delegated to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to 172.253.63.105, an address owned by AS15169 Google LLC located in the United States, indicating the operators are leveraging a legitimate Google‑owned IP space to increase credibility. No TLS certificate was observed, meaning the site would be delivered over plain HTTP if accessed.

The HTTP response returned a page title of “Google,” matching the declared brand target, and the scam type is identified as “Fake Airdrop.” The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service. Independent scoring from Gridinsoft assigns a trust score of 0 / 100, reflecting a high confidence of malicious intent. VirusTotal analysis records 14 of 95 scanning engines flagging the domain as malicious, reinforcing the blocklist findings. The current operational status is offline, suggesting the infrastructure has been taken down or is temporarily inactive.

Defenders should continue to enforce deny‑list rules for wlfi.airdropalerts.icu, monitor for any re‑registration or new subdomains under the same registrar, and consider broader surveillance of Cloudflare‑hosted domains that resolve to Google ASNs but lack SSL and exhibit low trust scores. Because the domain uses a legitimate Google IP range, network‑level detection may be required to avoid false positives on benign Google traffic. Ongoing intelligence collection is recommended to capture any resurgence or related campaigns.