airdrop[.]naorisnetwork[.]xyz

The domain airdrop.naorisnetwork.xyz was registered on February 21, 2026 and is currently taken offline. DNS resolution points to the IP address 142.250.184.228, which belongs to AS15169 Google LLC and is geolocated in the United States. The hosting infrastructure therefore shares the same autonomous system as legitimate Google services, a tactic often used to lend credibility to fraudulent sites. The site presented a page title of "Google," matching the declared brand target of Google, and is classified as a tech support scam in the intelligence feed.

An SSL certificate identified as WE2 was observed, indicating that the domain was served over HTTPS, a common approach to mimic trusted sites. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence in the domain’s legitimacy. The domain appears on one security blocklist and is specifically blocked by PhishDestroy, confirming that at least one anti‑phishing service has taken action against it.

VirusTotal analysis recorded four detections out of ninety‑three scanned security vendors, providing additional corroboration of malicious intent. Given the combination of brand impersonation, use of Google‑owned IP space, HTTPS deployment, low trust rating, and multiple independent detections, the evidence strongly supports the conclusion that airdrop.naorisnetwork.xyz was employed for a targeted tech‑support fraud campaign. Defenders should continue to block the domain at network perimeter controls, update threat intelligence feeds with the observed indicators, and monitor for any re‑registration attempts or related infrastructure that may be leveraged in future campaigns.