deepbook[.]airdropalerts[.]pro

Analysis of deepbook.airdropalerts.pro, observed on July 25, 2026, indicates that the domain is being used for a crypto‑related scam that impersonates Google. The domain was registered through Dynadot LLC on November 27, 2025 and currently resolves to the IP address 142.250.184.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The authoritative nameservers are alexa.ns.cloudflare.com and randall.ns.cloudflare.com, both hosted by Cloudflare. No TLS certificate was presented during the scan, meaning the site operated without HTTPS protection.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of confidence in the domain’s legitimacy. VirusTotal recorded seven positive detections out of ninety‑three scanning engines, and the domain appears on a single security blocklist, where it has been flagged by PhishDestroy. The page title returned by the server is "Google," matching the declared brand target. The site is presently offline, and its risk rating is classified as elevated.

The observable evidence confirms that the domain leverages a legitimate Google‑owned IP range to lend credibility to the malicious campaign, while the absence of SSL and the low trust score further underscore its malicious intent. Defenders should block the domain at the network perimeter, update DNS filtering policies to deny resolutions to the listed IP, and ensure endpoint security products incorporate the observed VirusTotal detections. Continuous monitoring of the associated Cloudflare nameservers is advised, as future campaigns may reuse the same infrastructure.