dolomite[.]airdropsalert[.]onl

The domain dolomite.airdropsalert.onl was observed targeting the Google brand and is currently classified as a high‑risk crypto‑related impersonation site. Infrastructure analysis shows the domain resolves to IP address 142.250.184.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain was registered on October 18, 2025 through Dynadot LLC and uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is present, indicating the site operates without HTTPS protection.

The page title returned by the HTTP response is "Google," which aligns with the declared brand target. Google Safe Browsing has flagged the URL for social engineering, and VirusTotal reports that 16 out of 95 security vendors have flagged the domain as malicious. The domain appears on one public blocklist and has been actively blocked by the PhishDestroy mitigation service. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

The site is associated with a crypto scam payload, although the specific payload details are not publicly disclosed. At the time of reporting (July 23, 2026) the domain is offline, but the underlying infrastructure, including the IP address and name server configuration, remains under the control of the threat actor. Defenders should continue to block the domain at perimeter defenses, monitor the associated IP for any reactivation, and add the domain to internal deny lists. Security teams are advised to watch for any new subdomains or similar patterns using the same registrar or name server pair, as threat actors frequently recycle these components for future campaigns.