aethir[.]airdropsalert[.]biz

The domain aethir.airdropsalert.biz was registered through Dynadot LLC on 18 October 2025 and is currently listed as offline. Technical analysis shows it resolves to the IP address 142.250.185.228, which is owned by Google LLC (AS15169) and geo‑located in the United States. The domain uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) but does not present an SSL certificate, indicating an HTTP‑only service at the time of observation. The page title returned from the site is "Google," matching the declared brand target of Google and confirming a brand‑impersonation motive.

The scam classification recorded is a crypto scam, suggesting that any content that was hosted likely attempted to lure victims into cryptocurrency‑related fraud. Detection services provide concrete evidence of malicious activity: fifteen of ninety‑five VirusTotal scanners flagged the domain, Google Safe Browsing categorised it as social engineering, and it appears on at least one security blocklist, with PhishDestroy actively blocking it. No additional threat intelligence sources such as OTX or external analysis links are presently available.

The combination of a legitimate‑looking Google‑owned IP, lack of TLS, and brand‑spoofing tactics points to a deliberate attempt to exploit the trust associated with Google’s infrastructure. Defenders should ensure that the domain is added to local and network‑level blocklists, monitor for newly registered look‑alike domains that use similar sub‑domains (e.g., airdropsalert.biz), and consider tightening DNS filtering rules for the parent zone. Given the offline status, ongoing surveillance of the associated IP range and registrar activity is recommended to detect any re‑use of the same infrastructure for future campaigns.