eul[.]app-airdropalert[.]lol

Analysis of the domain eul.app-airdropalert.lol indicates it was actively impersonating Google as part of a cryptocurrency scam. The domain, registered on November 10, 2025, through Dynadot LLC, resolved to the IP address 142.250.185.132, which is associated with AS15169 (Google LLC) in the United States. Despite the IP's legitimate ownership, the domain itself exhibited multiple indicators of malicious activity. The page title was explicitly set to 'Google,' and the domain was classified as a crypto scam, though no specific details about the scam mechanics or on-page content are available for verification.

Infrastructure analysis reveals the domain was hosted behind Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure the true hosting origin. No SSL certificate was present, which is atypical for legitimate services but consistent with hastily deployed phishing infrastructure. The domain was flagged by 14 out of 95 security vendors on VirusTotal, and it appeared on at least one security blocklist, including PhishDestroy. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification.

As of July 23, 2026, the domain is offline, though its prior resolution to a Google-owned IP may indicate an attempt to exploit perceived legitimacy. Defenders should treat this domain as a confirmed threat and block it at the network level. Monitoring for related domains using the same registration pattern (Dynadot, Cloudflare nameservers) or targeting similar brands is recommended. While the domain is inactive, its infrastructure and registration details remain relevant for retrospective threat hunting and correlation with other campaigns.