yield[.]airsdropsalert[.]lol

Analysis of yield.airsdropsalert.lol indicates that the domain was registered through Dynadot LLC on 5 November 2025 and is currently taken offline. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, pointing to a Cloudflare DNS service. DNS resolution maps the domain to IP address 142.250.74.196, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. No SSL certificate was observed during the scan, meaning the site was served over plain HTTP. The page title returned by the server is "Google", matching the declared brand target and confirming the intent to impersonate Google.

The threat is classified as a brand‑impersonation campaign. Gridinsoft assigned a trust score of 0 out of 100, indicating a highly malicious reputation. VirusTotal recorded five detections out of ninety‑five scanners, and the domain appears on one security blocklist. PhishDestroy has also listed the domain as blocked.

The lack of an active HTTPS layer and the use of a Google‑owned IP address suggest an attempt to increase credibility, although the domain does not host a valid SSL certificate. Current evidence does not reveal the specific payload or phishing page content beyond the title, so the exact tactics employed remain uncertain. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence, and ensure that any outbound connections to the associated IP are inspected. Additional threat‑intel feeds should be consulted for possible related indicators, and users should be educated to ignore unsolicited requests appearing to originate from Google‑related URLs that lack proper TLS protection.