mole[.]airdropalerts[.]bond

The domain mole.airdropalerts.bond was registered on October 14, 2025 through Dynadoc LLC and is currently listed as offline. DNS resolution points to IP address 142.251.40.132, an address owned by Google LLC (AS15169) located in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both hosted by Cloudflare. No TLS certificate is presented for the domain, indicating that HTTPS is not available.

The page title returned from the site is "Google", and the domain is classified as a fake‑airdrop campaign that impersonates the Google brand. Detection vectors include a block by PhishDestroy and inclusion on a single security blocklist. VirusTotal analysis shows that 11 of 95 scanned security vendors flagged the domain as malicious. Although the site is presently taken offline, the infrastructure components—particularly the use of a legitimate Google IP and Cloudflare nameservers—suggest an attempt to exploit the trust associated with the target brand.

Defenders should continue to monitor the domain’s DNS records for any re‑activation, add the domain to internal blocklists, and enforce strict HTTPS validation to prevent accidental trust of unencrypted endpoints. Because the domain lacks a valid SSL certificate, any future re‑hosting would be easily detectable by TLS inspection tools. Network sensors should flag outbound connections to 142.251.40.132 originating from unexpected internal sources, and incident response teams should investigate any logs that reference mole.airdropalerts.bond or related subdomains. The limited visibility from only one blocklist and the modest VirusTotal detection count indicate that broader threat‑intel platforms may not yet have indexed the indicator; therefore, proactive sharing of this indicator with peer organizations and inclusion in threat‑feed subscriptions is advisable to improve collective detection coverage.