airdropsalerts[.]help

This domain, airdropsalerts.help, is identified as a high-risk brand impersonation threat targeting Facebook. Analysis indicates the site was designed to deceive users into believing they were interacting with legitimate Facebook services, likely through fake login portals or fraudulent airdrop notifications. No direct evidence of a crypto drainer kit was observed, but the domain's structure and page title manipulation suggest intent to harvest credentials or distribute malicious payloads under the guise of Facebook promotions or alerts.

Technical indicators confirm the domain was registered on November 21, 2025, through Dynadot LLC, resolving to the IP address 172.253.115.99, hosted on infrastructure belonging to Google LLC (AS15169). VirusTotal detections show 17 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly marks it as phishing. The domain appears on one security blocklist, and its SSL certificate, issued by Google Trust Services (WE1), aligns with the hosting provider but does not mitigate the underlying threat. The page title, 'Google,' further indicates an attempt to mislead users or evade automated detection systems by mimicking unrelated services.

As of the latest assessment, airdropsalerts.help has been taken offline, likely due to enforcement actions by hosting providers or security entities. However, residual risk persists for users who may have interacted with the domain prior to its removal. Organizations and individuals are advised to monitor for unauthorized access attempts linked to Facebook credentials, review logs for connections to the IP 172.253.115.99, and implement additional authentication measures for accounts potentially exposed during the domain's active period. The registrar, Dynadot LLC, should be notified of any remaining malicious activity associated with this domain to prevent re-registration or abuse of similar infrastructure.