spaceandtime[.]airdropsalert[.]biz

This domain, spaceandtime.airdropsalert.biz, was observed hosting a page whose title is exactly "Google", indicating an attempt to impersonate the Google brand. The domain resolves to the IP address 142.250.72.100, which belongs to AS15169 Google LLC and is geolocated in the United States. Registration data show the domain was created on 18 October 2025 through Dynadot LLC, and the authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was presented during connection attempts, leaving the site unencrypted.

Threat‑intel feeds report that the site is classified as a crypto‑scam and that it has been blocked by the PhishDestroy service. It appears on a single security blocklist and 16 of 95 VirusTotal scanners flagged the domain as malicious. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in its malicious nature. The current operational state is offline, and the domain has been taken down, but the historical indicators remain relevant for detection rules.

Analysis indicates that the combination of brand impersonation, a cloud‑based hosting footprint, and the absence of SSL suggests a short‑lived infrastructure designed to lure victims into a cryptocurrency‑related fraud. Uncertainty remains regarding the exact payload or payment mechanism because the site content has not been captured. Defenders should continue to block the domain at perimeter and DNS layers, add the associated IP address to blacklists, and monitor the registrar and name‑server records for any re‑registration attempts. Ongoing correlation with threat‑intel sources is advised to capture any resurgence of the same infrastructure under a new label.