zero[.]airdropsalert[.]app

The domain zero.airdropsalert.app was observed pointing to the IP address 142.250.185.132, which resolves to a Google‑owned network (AS15169, United States). Registration information indicates the domain is hosted through Cloudflare, Inc., and no authoritative nameserver records could be retrieved. No SSL certificate was presented for the site, and the HTTP service is currently offline. The page title returned by the server is "Google," matching the declared brand target of Google.

Risk assessment tools assign a Gridinsoft trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis reports that fifteen of ninety‑five scanning engines flagged the domain as malicious, providing independent corroboration of its malicious nature. The domain appears on a single security blocklist and is listed by the PhishDestroy mitigation service, further confirming its reputation as a threat.

The combined evidence—cloud‑based registration, lack of TLS, low trust score, multiple vendor detections, and blocklist listings—indicates that the domain was being used for a crypto‑related brand‑impersonation campaign targeting Google users. Defensive operators should continue to enforce blocking of the domain and its associated IP address across perimeter and endpoint controls, monitor Cloudflare‑registered subdomains for similar patterns, and incorporate the observed indicators of compromise into threat‑intel feeds. Ongoing observation is advised to detect any re‑activation or re‑use of the infrastructure, as the current status is offline but the underlying IP is owned by a major cloud provider.