aztec[.]airdropsalert[.]biz

On 23 July 2026, aztec.airdropsalert.biz was identified as a high‑risk brand‑impersonation campaign targeting Google. The domain was registered on 18 October 2025 through Dynadot LLC and is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to 142.250.186.68, an address owned by AS15169 Google LLC located in Germany, which suggests the attacker deliberately leveraged a legitimate Google IP range to increase credibility. No TLS certificate is presented, causing the site to be served over plain HTTP.

The page title returned by the HTTP response is "Google", reinforcing the impersonation claim. The site is classified as a crypto‑scam, and Google Safe Browsing flags it for social engineering. Detection engines on VirusTotal recorded 14 positive detections out of 95 scanners, and the domain appears on a single external blocklist. Reputation services assign extremely low trust scores, with Scamadviser reporting 1/100 and Gridinsoft 0/100.

PhishDestroy has already blocked the domain, and the current operational status is offline. Evidence gaps remain regarding the exact content delivered to victims, the phishing kit employed, and any command‑and‑control infrastructure, as the site is no longer reachable for direct inspection. Defenders should continue to block the domain at network perimeter and DNS layers, update web‑filter and endpoint signatures with the observed indicators, and monitor for any newly registered domains that reuse the same registrar, name‑server pattern, or resolve to the same Google‑owned IP range. Incident response teams should also verify that no credential or cryptocurrency address harvesting occurred from users who may have visited the site before it was taken down.