spaceandtime[.]airdropalert[.]us

The domain spaceandtime.airdropalert.us was registered on October 19, 2025 through Dynadot LLC and resolves to the IP address 192.178.155.105, which is registered to AS15169 Google LLC in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented for the host, indicating an unencrypted HTTP service. The page title returned from the site is "Google," matching the declared brand target of Google and confirming the domain’s intent to impersonate that brand.

The site is classified as a crypto scam, although the specific payload or transaction flow has not been observed. Security telemetry shows the domain appears on a single blocklist, PhishDestroy, and VirusTotal reports that 11 of 93 scanned security vendors flagged the domain as malicious. A Gridinsoft trust score of 0 out of 100 further underscores its malicious reputation. The domain’s current status is offline, suggesting that the phishing infrastructure may have been taken down or is no longer actively serving content.

Despite the offline state, the observed infrastructure—particularly the use of Google‑owned IP space and Cloudflare DNS—highlights a pattern of leveraging high‑reputation assets to increase credibility. Defenders should continue to block the domain and its resolved IP address at network perimeters, update URL filtering policies to include the observed blocklist entry, and monitor for newly registered domains that resolve to the same IP range or employ similar naming patterns. Ongoing observation of the registrar Dynadot and the Cloudflare nameservers may reveal additional related campaigns. Continuous re‑evaluation of detection vendor feeds is recommended, as further analysis could surface new indicators of compromise associated with this brand‑impersonation campaign.