degen[.]airdrpalert[.]click

The domain degen.airdrpalert.click was observed to resolve to the IP address 216.58.206.68, an address allocated to Google LLC (AS15169) and geolocated in Germany. The use of a Google‑owned IP for a brand‑impersonation campaign suggests the adversary is leveraging legitimate hosting infrastructure to increase credibility and bypass naïve network controls. Registration data indicate the domain was created on October 30, 2025 and was registered through Dynadot LLC. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both hosted by Cloudflare, which is a common choice for fast‑changing malicious infrastructure. No TLS certificate was presented during probing, meaning the site was reachable only over HTTP. The page title returned by the server is "Google", matching the declared brand target of Google and reinforcing the impersonation intent.

VirusTotal analysis recorded three positive detections out of ninety‑five scanned security vendors, confirming that multiple independent scanners flagged the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, indicating that at least one commercial anti‑phishing solution has incorporated it into its defensive feeds. Gridinsoft’s trust scoring system assigned a rating of 0 out of 100, the lowest possible score, further reflecting a high confidence in its malicious nature. The overall risk level is classified as elevated, and the current operational status is offline, suggesting that the site may have been taken down or is no longer serving content.

Defenders should treat degen.airdrpalert.click as a confirmed malicious resource. Immediate actions include adding the domain and its associated IP address to internal blocklists, updating DNS filtering rules to deny resolutions, and monitoring for any residual traffic to the IP that may indicate cached or redirected content.