polkadot[.]airsdropsalert[.]click

Analysis of polkadot.airsdropsalert.click shows a confirmed brand‑impersonation infrastructure targeting Google users. The domain was registered through Dynadot LLC on November 5, 2025 and resolves to IP address 142.250.186.132, which belongs to AS15169 Google LLC located in the United States. The hosting appears to be on Google’s own network, but the lack of an SSL certificate indicates the site was served over plain HTTP. The page title returned by the server was "Google," matching the declared brand target, and the site was classified as a brand‑impersonation scam.

VirusTotal scans recorded 13 detections out of 95 security vendors, and the Gridinsoft trust score was 0 / 100, reinforcing its malicious nature. The domain is currently listed on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that the hosting was taken offline. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com are Cloudflare‑managed, a common choice for fast‑fluctuating malicious domains. While the exact phishing kit or post‑compromise payload has not been observed, the convergence of vendor detections, blocklist presence, and the brand‑impersonation label provides sufficient confidence to treat the domain as malicious.

Defensive teams should ensure that DNS filters block polkadot.airsdropsalert.click, add the IP 142.250.186.132 to network‑level deny lists, and monitor for any future re‑registration attempts. Incident response actions should include reviewing logs for any outbound connections to this domain or IP, updating URL filtering rules in web proxies, and alerting users about the spoofed Google page title. Continuous monitoring of the registrar Dynadot and Cloudflare nameserver activity is advised to detect potential re‑use of similar infrastructure.