usual[.]app-airdropalert[.]sbs

Analysis of usual.app-airdropalert.sbs shows a domain registered on November 10, 2025 through Dynadot LLC. The domain is delegated to Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but it does not present a valid SSL certificate, indicating that any network traffic would occur over unencrypted HTTP. DNS resolution points to IP address 142.251.140.164, which is owned by Google LLC (AS15169) and geolocated in the United States. The page title returned from the site is "Google," and the intelligence set classifies the activity as a brand impersonation targeting Google and a crypto‑related scam.

Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on at least one security blocklist, with PhishDestroy confirming a block. VirusTotal scans have flagged the domain by 12 of 95 security vendors, reinforcing the malicious assessment. The current operational status is offline, so live content cannot be examined, leaving the exact payload or phishing page design unknown.

Defenders should continue to block the domain at network perimeters and endpoint filters, monitor the associated IP for any future services, and watch for similarly structured subdomains that reuse the same registrar or Cloudflare name servers. Updating allowlists to exclude this host and applying URL filtering based on the observed page title and brand impersonation indicator will reduce exposure. Continuous re‑evaluation is advised if the domain returns online, as additional indicators such as malicious scripts or credential‑harvesting forms may emerge.