grt[.]airdropalerts[.]pro

This domain, grt.airdropalerts.pro, was created on 27 November 2025 and is registered through Dynadot LLC. The authoritative nameservers are alexa.ns.cloudflare.com and randall.ns.cloudflare.com, indicating use of Cloudflare DNS services. The site resolves to the IPv4 address 192.178.155.104, which belongs to AS15169 Google LLC and is geolocated in the United States. Despite the IP belonging to Google’s network, the domain hosts no TLS certificate, leaving HTTP connections unencrypted. The page title returned by the web server is “Google”, and the brand target is identified as Google, matching the impersonation intent. The scam type is listed as a crypto scam, suggesting attempts to lure victims into cryptocurrency‑related fraud.

Detection data show that 12 of 93 security vendors on VirusTotal flagged the domain, and the domain appears on one external security blocklist. PhishDestroy has also blocked the domain, confirming its inclusion in active remediation feeds. A Gridinsoft trust score of 0 out of 100 further indicates a high likelihood of malicious intent. The current operational status is offline, as the hosting has been taken down.

Based on the available evidence, the primary indicators of compromise are the mismatched brand usage, lack of TLS, low trust score, and vendor detections. Uncertainties include the exact payload or page content, as no visual analysis is available. Defenders should block the domain at DNS and proxy layers, monitor for any traffic to the associated IP address, and update detection signatures to include the observed nameserver pattern and the low trust score flag. Continuous monitoring of the registrar Dynadot for any re‑registration attempts is also advised.