w[.]airsdropsalerts[.]cfd

This domain w.airsdropsalerts.cfd was registered via Dynadot LLC on 7 November 2025. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS. DNS resolution points to IP address 142.251.167.103, which belongs to AS15169 Google LLC and is geolocated in the United States. The hosting IP is owned by Google, a common tactic for brand‑impersonation campaigns seeking to lend credibility to malicious sites. No TLS certificate was observed; the site served HTTP only, which further differentiates it from legitimate Google services that enforce HTTPS.

The page title returned by the host is the literal string “Google”, matching the declared brand target. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that 11 out of 95 scanned security vendors flagged the domain as malicious, providing independent confirmation of suspicious behavior. The current operational status is offline, but the infrastructure components remain observable and could be re‑activated. Uncertainty remains around the exact payload or credential‑harvesting mechanism because the content has not been captured; no malware kit or specific phishing page details are available.

Defenders should add the domain to perimeter blocklists, monitor DNS queries for the two Cloudflare nameservers, and watch for any future resolution to the same Google‑owned IP. Correlation with other domains using the same nameservers or IP may reveal additional campaign elements. Continuous re‑scanning on VirusTotal or similar services is advised to capture any changes in detection scores. Organizations that enforce strict URL filtering for the Google brand should ensure that any request to w.airsdropsalerts.cfd is denied, and incident response teams should treat any logs referencing this domain as potential credential‑theft attempts.