haedal[.]airdropsalert[.]us

The domain haedal.airdropsalert.us was registered on October 18, 2025 through Dynadot LLC and is currently listed as offline. Infrastructure analysis shows the domain is delegated to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, yet its A record resolves to 172.253.63.103, an IP owned by AS15169 Google LLC and located in the United States. No SSL certificate is presented, indicating that any previous service was delivered over plain HTTP. The page title observed during earlier scans was "Google," aligning with the declared impersonation of the Google brand.

The site was identified as a crypto‑scam, and Google Safe Browsing flagged it for social engineering. It appears on a single security blocklist, PhishDestroy, and VirusTotal records show that 12 of 93 scanned vendors flagged the domain as malicious. The Gridinsoft trust score of 0 out of 100 further reinforces a high‑risk assessment. While the domain is presently taken offline, the combination of brand impersonation, lack of TLS, low trust score, and multiple vendor detections suggests a deliberate attempt to lure victims into a cryptocurrency‑related fraud.

Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any re‑hosting activity, and add the domain to internal blocklists. Given the Cloudflare name server configuration, any future re‑activation could involve rapid changes, so continuous threat‑intel feeds should be consulted. Organizations using Google brand assets should educate users about the absence of a valid SSL certificate and the presence of a generic "Google" page title, which differs from official Google domains that always employ HTTPS and verified certificates.