fil[.]app-airdropalert[.]lol

fil.app-airdropalert.lol was observed by multiple intel sources on July 23, 2026. The domain was registered through Dynadot LLC on 10 Nov 2025 and resolves to IP 142.250.185.68, which belongs to AS15169 Google LLC located in the United States. The IP is part of Google’s public infrastructure, yet the domain is not listed in any Google‑owned namespace and lacks an SSL certificate. VirusTotal reports that 13 of 95 scanned security vendors flag the domain as malicious, indicating a moderate consensus of malicious intent. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one external security blocklist.

Its authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both hosted by Cloudflare. The site’s HTTP response is currently offline, and PhishDestroy has already added the domain to its blocklist. The page title returned from the server is “Google”, matching the declared brand target, and the intelligence categorises the operation as a crypto‑scam that impersonates Google. No TLS certificate is present, which further reduces trustworthiness and may facilitate credential harvesting or malicious redirects.

The combination of a brand‑spoofing page title, a low trust score, multiple vendor detections, and inclusion on a phishing blocklist strongly suggests that the domain was used to lure victims into a cryptocurrency‑related fraud. Open questions remain regarding the exact payload delivered, the presence of any login or payment collection forms, and whether additional C2 infrastructure is associated with the same IP range. Defenders should immediately block DNS resolution for fil.app‑airdropalert.lol, enforce HTTPS inspection rules to catch any future re‑hosting, and monitor for similarly structured sub‑domains that resolve to Google‑owned IP space. Continuous re‑scanning on VirusTotal and integration of blocklist updates are recommended to capture any evolution of the threat.