airdropsalert[.]vip

On 19 October 2025 the domain airdropsalert.vip was registered through Dynadot LLC. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, which resolve the domain to the IP address 142.250.185.164. The IP belongs to AS15169, attributed to Google LLC and is geolocated in the United States. No TLS certificate is presented; HTTPS connections are not available. The site’s HTML title is the literal string “Google”, and the domain is classified as a “Fake Airdrop” campaign that targets the Google brand.

VirusTotal analysis shows that six of ninety‑five scanned scanners flagged the domain as malicious, indicating partial detection across the vendor ecosystem. The domain is currently offline, but it was listed on four independent blocklists – PhishDestroy, Polkadot, Enkrypt, and Codeesura – which have already taken it down in their respective filtering services. The lack of SSL, combined with the use of legitimate Google‑owned infrastructure, is a typical evasion technique that can lend credibility to the fraudulent offering. Defenders should add airdropsalert.vip to local deny‑list rules, ensure that any outbound traffic to the associated IP is blocked, and monitor for newly registered domains that resolve to Google‑owned address space while presenting unrelated brand titles.

Continuous ingestion of blocklist feeds that contain this indicator will help prevent re‑use of the same infrastructure. Analysts should also watch for similar “Fake Airdrop” patterns that reference Google, as the campaign may evolve to other brand‑specific lures. The current evidence does not provide details on the payload or user‑facing content, so further content‑capture analysis would be required if the domain becomes active again.