degen[.]app-airdropalert[.]sbs

On July 23, 2026, the domain degen.app-airdropalert.sbs was identified as an elevated‑risk brand‑impersonation site targeting Google users. The domain was registered through Dynadot LLC and has a creation date of 10 November 2025. Its authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS services. DNS resolution points to IP address 142.250.181.228, which belongs to AS15169, Google LLC, and is geolocated in the United States. No TLS certificate was observed, meaning the site served only HTTP traffic.

The page title returned by the server is the single word “Google”, matching the declared brand target and confirming the intent to masquerade as a Google service. Threat intelligence aggregators have listed the domain on one security blocklist, and PhishDestroy has actively blocked it. VirusTotal analysis shows that ten of ninety‑five scanning engines flagged the domain as malicious, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The infrastructure choices—use of a legitimate Google‑owned IP address and Cloudflare DNS—suggest an attempt to leverage trusted network reputation to evade detection. However, the lack of an SSL certificate and the low detection count indicate that the site may have been short‑lived or limited in exposure before being taken offline.

Current status is offline, but the domain could be re‑activated or used as a redirect in future campaigns. Defenders should continue to block the domain at DNS and web‑filter layers, monitor traffic to the associated IP address for any anomalous requests, and apply URL‑filtering rules that reference the observed page title “Google”. Incident response teams should also update internal phishing‑signature databases with the domain and associated indicators, and consider sharing the indicator set with threat‑sharing communities to aid broader detection.