degen[.]airdropsalert[.]live

On July 23, 2026, the domain degen.airdropsalert.live was observed hosting a fraudulent page that used the page title “Google” and claimed to deliver a Gmail‑related airdrop. The site was registered through Cloudflare, Inc., but no SSL certificate was presented, allowing only unencrypted HTTP connections. An HTTP 200 response was returned for the root path, indicating an active web server at the time of capture. The host resolved to IP address 192.178.218.103, which belongs to AS15169 Google LLC and is geolocated in the United States.

Despite the legitimate‑looking IP ownership, the domain was flagged by Google Safe Browsing as a social‑engineering threat and appears on one external security blocklist. VirusTotal recorded detections from 14 of 95 scanning engines, reinforcing the malicious classification. The domain was also listed by PhishDestroy, which subsequently took the site offline. Nameserver information could not be retrieved (NS_NOT_FOUND).

The combination of a brand‑impersonation vector (targeting Gmail users), a fake‑airdrop narrative, lack of TLS, and multiple independent detections suggests a high‑risk credential‑harvesting campaign. Defenders should add degen.airdropsalert.live to deny‑list rules, monitor for similarly structured subdomains under the “airdropsalert.live” suffix, and enforce strict TLS‑only policies to mitigate traffic to non‑encrypted endpoints. Continuous threat‑intel feeds should be consulted for any re‑registration attempts, and endpoint security solutions should be updated to recognize the observed indicator set, including the specific IP address and the “Google” page title fingerprint.