euler[.]airdropsalert[.]lol

This domain euler.airdropsalert.lol is currently offline but historical data indicate it was used for a brand‑impersonation campaign targeting Google users with a fake airdrop lure. The domain was registered on 18 October 2025 through Dynadot LLC and resolved to the IPv6 address 2607:f8b0:4004:c23::69, which belongs to AS15169 owned by Google LLC and is located in the United States. The hosting infrastructure is fronted by Cloudflare, as evidenced by the authoritative name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was observed, meaning the site was served over plaintext HTTP.

The page title returned was “Google”, matching the declared brand target. Threat intelligence shows the site was flagged by Google Safe Browsing for social‑engineering content, appears on one public blocklist, and was identified by PhishDestroy as malicious. VirusTotal recorded 13 positive detections out of 95 scanners, and the Gridinsoft trust score was 0 / 100, reinforcing the malicious assessment. Because the site is now taken offline, active exploitation cannot be confirmed, but the combination of brand impersonation, fake‑airdrop terminology, and multiple vendor detections demonstrates a high‑risk profile.

Defenders should ensure the domain is added to local deny lists, verify that any internal DNS resolvers block both the IPv6 address and its associated A‑record, and monitor for newly‑registered look‑alike domains under the airdropsalert.lol second‑level domain. Continuous ingestion of blocklist feeds that flagged this indicator, as well as periodic re‑query of Google Safe Browsing, will help detect re‑use of the same infrastructure. Given the absence of a TLS certificate, any future redeployment would likely continue to rely on HTTP, simplifying detection through outbound request monitoring. Until the infrastructure is definitively retired, the domain should be treated as hostile and excluded from any allow‑list policies.