dbr[.]airdropsalert[.]app

Analysis of dbr.airdropsalert.app reveals a high‑risk brand‑impersonation infrastructure targeting Google users. The domain resolves to the IP address 142.250.185.100, which is owned by Google LLC (AS15169) and geolocated in the United States. Despite being hosted on a Google‑owned address, the domain is registered through Cloudflare, Inc., and does not present an SSL/TLS certificate, indicating that any web service would be delivered over plain HTTP. The page title returned by the server is "Google," matching the declared brand target and confirming intentional brand impersonation.

Multiple defensive data sources flag the domain. Google Safe Browsing classifies it as a social‑engineering threat, and the site appears on one external security blocklist. PhishDestroy has actively blocked the domain, and the Gridinsoft trust score is 0 out of 100, reflecting an extreme lack of trust. VirusTotal analysis shows that 16 of 95 scanned security vendors label the domain as malicious, reinforcing the suspicion of malicious activity. The primary scam type associated with the infrastructure is a crypto scam, and the site is listed as impersonating Google.

The domain is currently offline, but the historical evidence suggests it was used to lure victims into a cryptocurrency‑related fraud scheme while masquerading as a legitimate Google service. Defenders should add the domain and its associated IP address to deny lists, monitor for any re‑registration attempts, and ensure that web filtering solutions block connections to the host. Given the lack of TLS encryption, the low trust score, and the social‑engineering flag, any traffic to the domain should be considered hostile. Continuous observation of Cloudflare registration changes and periodic re‑scanning with VirusTotal are recommended to detect potential re‑activation.