airdropalerts[.]dev

The domain airdropalerts.dev was observed hosting a crypto‑related scam that masquerades as Google, as indicated by the page title “Google” and the explicit “Impersonates: Google” tag. The site was served without an SSL certificate, exposing all HTTP traffic to interception. DNS resolution pointed to 142.250.184.228, an address owned by Google LLC (AS15169) located in the United States. The domain leveraged Cloudflare’s DNS service, using the nameservers alexa.ns.cloudflare.com and randall.ns.cloudflare.com, and the registration record lists Cloudflare, Inc. as the registrar.

A Gridinsoft trust score of 0 out of 100 further confirms the malicious nature of the infrastructure. The domain appeared on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—and is currently listed as offline, indicating that the operator has taken the site down, either voluntarily or as a result of takedown actions. VirusTotal analysis shows that four of ninety‑five scanners flagged the domain, reinforcing the detection consensus. No TLS certificate was present, and no Safe Browsing or OTX entries were provided in the available intelligence.

Defenders should immediately add airdropalerts.dev to URL filtering and DNS block policies, monitor for any re‑registration attempts, and consider correlating internal logs for traffic to the associated IP address. Continuous observation of Cloudflare‑registered domains that resolve to Google‑owned IP ranges is recommended, as threat actors frequently abuse such infrastructure to lend credibility to fraudulent campaigns. Because the site is offline, active takedown verification is not possible, but the documented indicators should be retained in threat‑intel feeds for future reference.