s[.]airdropsalert[.]us

Analysis of the domain s.airdropsalert.us indicates a malicious infrastructure designed to impersonate Google for a cryptocurrency‑related scam. The domain was registered on 18 October 2025 through Dynadot LLC and is hosted on the IP address 172.253.122.104, which belongs to AS15169 Google LLC in the United States. The domain resolves via Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, yet no TLS certificate is presented, leaving the site accessible only over plain HTTP. The page title returned from the live host is “Google”, matching the declared brand target of Google and reinforcing the impersonation intent.

Static analysis shows a Gridinsoft trust score of 0 out of 100, indicating an extremely low reputation. VirusTotal has recorded detections from 12 of 93 security vendors, and the domain appears on one public blocklist. PhishDestroy has already taken the domain offline, and the current status is listed as offline. Despite the offline state, the presence of the IP address within Google’s network suggests the attacker deliberately leveraged legitimate hosting to increase credibility.

Defenders should continue to block the domain and its associated IP at network perimeters, enforce DNS filtering based on the known blocklist entry, and monitor for any future resurrection of the domain or similar sub‑domains using the same naming pattern. Because the site lacks an SSL certificate, any attempt to serve content over HTTPS would be immediately suspicious. Continuous observation of Dynadot‑registered domains that resolve to Google‑owned IP ranges is recommended to catch early provisioning of comparable campaigns. The limited detection footprint and the absence of a TLS layer leave open the possibility that the operators may repurpose the same infrastructure for new campaigns, so threat‑intel feeds should be updated with the indicators of compromise identified herein.