vvv[.]airdropsalert[.]onl

This domain, vvv.airdropsalert.onl, was identified as a crypto scam impersonating Google, with infrastructure analysis revealing elevated risk indicators. Registered on October 18, 2025, through Dynadot LLC, the domain resolved to an IPv6 address (2607:f8b0:4004:c09::69) associated with Google LLC (AS15169) in the United States. The page title explicitly displayed 'Google,' aligning with the brand impersonation classification. No SSL certificate was detected, increasing susceptibility to interception or tampering.

The domain was flagged by 15 of 95 security vendors on VirusTotal and appeared on the PhishDestroy blocklist, confirming its malicious classification. Nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) suggest Cloudflare infrastructure, though no active content was accessible at the time of assessment. The domain was taken offline prior to July 23, 2026, but residual DNS records and detection history remain relevant for defenders.

Organizations should monitor for residual DNS queries, block the domain at perimeter security controls, and review logs for prior connections to this infrastructure. The absence of an SSL certificate and the use of Google-associated IP space may indicate an attempt to exploit perceived legitimacy, though no evidence of a specific phishing kit or payload was available for analysis. Defenders are advised to treat this domain as compromised and prioritize remediation for any systems that interacted with it.