metis[.]airdropalerts[.]bond

This domain was registered through Dynadot LLC on 14 October 2025 and resolves to the IP address 142.251.179.147, which belongs to AS15169 Google LLC located in the United States. The site presented the page title “Google” and was classified as a fake‑airdrop campaign that impersonates Google, indicating a brand‑impersonation threat. The infrastructure uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate was observed, suggesting the site operated over plain HTTP. PhishDestroy has already blocked the domain and it appears on one external blocklist.

VirusTotal analysis recorded 11 detections out of 95 scanned vendors, confirming that a subset of security products recognize the domain as malicious. The current HTTP status is offline, and the site is no longer reachable. Because the domain points to a Google‑owned IP range, it may have been used to lend legitimacy to the fraudulent airdrop lure, but the exact content served before takedown has not been publicly disclosed.

Defensive teams should continue to deny any traffic to metis.airdropalerts.bond at the network perimeter, add the domain and its resolving IP to URL filtering and DNS sinkhole lists, and monitor for newly registered sub‑domains that reuse the same Cloudflare name‑server pattern. Additional observation of any future domains registered by Dynadot that target the “Google” brand with airdrop terminology is advised, as threat actors frequently recycle this infrastructure. Continuous re‑evaluation of blocklist status and periodic VirusTotal rescans are recommended to capture any changes in detection coverage.