defiapp[.]airdrpalert[.]click

Analysis of defiapp.airdrpalert.click confirms it as a crypto scam domain impersonating Google, currently offline as of July 22, 2026. The domain was registered on October 30, 2025, through Dynadot LLC and uses Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com). No SSL certificate is present, increasing the risk of unencrypted data interception. The domain resolves to IP 142.251.179.147, geolocated to the US under AS15169 (Google LLC), though this does not confirm hosting by Google.

The page title 'Google' aligns with the reported brand impersonation, and the scam type is explicitly classified as a crypto scam in available intelligence. Detection by PhishDestroy and a Gridinsoft trust score of 0/100 further support its malicious classification. Three of 95 security vendors on VirusTotal flagged the domain at the time of scanning, and it appears on one security blocklist. Defenders should treat this domain as high-risk for crypto-related phishing activity, particularly targeting users expecting Google services.

Infrastructure analysis reveals Cloudflare as the DNS provider, which may complicate takedown efforts. The domain's current offline status does not eliminate the risk of reactivation or reuse of its infrastructure. No evidence of a phishing kit or additional page content is available for analysis. Organizations should monitor for related domains using similar naming patterns (e.g., 'airdrpalert') and enforce blocklisting of this domain across security controls.