aethir[.]airdropsalert[.]xyz

Analysis of aethir.airdropsalert.xyz indicates that the domain was registered on October 17 2025 through Dynadot LLC and is currently offline. The domain resolves to IP 142.250.185.68, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. Despite the IP belonging to Google infrastructure, the domain does not present an SSL/TLS certificate, meaning any HTTP traffic would be unencrypted. The page title returned from the site is “Google”, matching the declared brand target. The domain is classified as a crypto‑scam that impersonates Google.

It has been blocked by the PhishDestroy sinkhole and appears on one external blocklist. The Gridinsoft trust score is 0 out of 100, reflecting a highly malicious rating. VirusTotal reports that 14 of 95 scanning engines flag the domain as malicious, reinforcing the suspicion. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS services. The lack of an SSL certificate and the offline status limit current active probing, but the historical evidence suggests the domain was used to lure victims into a cryptocurrency‑related fraud.

Uncertainty remains regarding the exact payload or phishing pages that were served before takedown, as no content snapshots are available. Defenders should continue to block the domain at perimeter filters, add it to internal blacklists, and monitor for any future re‑registration attempts. Threat intelligence feeds should be updated to reflect the association with Google brand impersonation and crypto‑scam activity. Continuous monitoring of the IP address and associated Cloudflare nameservers is advised, as they may be reused for other malicious campaigns.