metis[.]airdropsalert[.]life

metis.airdropsalert.life was registered on 17 October 2025 through Dynadot LLC. The domain resolves to 142.250.186.164, an address owned by Google LLC in the AS15169 network located in the United States. No TLS certificate is presented, indicating the site is served over plain HTTP only. The sole HTML title retrieved reads "Google", matching the declared brand target of Google and the listed scam type of a fake airdrop. VirusTotal analysis shows 13 of 95 scanning engines flag the domain as malicious, and the domain appears on a single external blocklist.

PhishDestroy has taken the site offline, and current network probes return no active service. The available evidence suggests the domain is part of a brand‑impersonation campaign that lures victims with a promised cryptocurrency airdrop while exploiting the Google brand to increase credibility. Infrastructure reuse of a legitimate Google IP range may be an attempt to blend with trusted traffic, but the lack of a valid SSL certificate and the mismatched title are typical indicators of a fraudulent endpoint. Because the site is presently offline, active payload collection is not possible, and the exact phishing page content remains unknown.

Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, add the IP address 142.250.186.164 to watchlists for anomalous traffic destined for Google‑owned ranges, and monitor for any re‑registration attempts. Updating Safe Browsing and other reputation feeds with the current detection count will help downstream clients flag future access attempts. Incident response teams should also review internal logs for any recent connections to this host, especially from users who may have been targeted by airdrop‑related lures. Ongoing surveillance is recommended until the domain is definitively taken down or the registration expires.