defiapp[.]airdrpalerts[.]cfd

The domain defiapp.airdrpalerts.cfd was registered on October 25 2025 through Dynadot LLC. It resolves to IP 142.250.186.132, which belongs to AS15169 Google LLC in the United States. The hosting appears to be provided by Cloudflare, as indicated by the authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is present; the site serves HTTP only, which is inconsistent with the brand being impersonated. The page title returned from the live host is simply “Google”, and the infrastructure metadata lists Google as the target brand. The known scam classification is a crypto‑related scam, and the domain has been flagged by two of ninety‑five VirusTotal scanners.

The Gridinsoft trust score is 0 out of 100, indicating a lack of reputation. The domain appears on one public blocklist and has been added to the PhishDestroy blocklist. At the time of analysis the site is reported as taken offline. These data points confirm that the domain was used for a brand‑impersonation campaign aimed at Google users, likely to lure victims into a cryptocurrency fraud. However, the exact phishing page content, credential‑capture mechanisms, and any associated command‑and‑control infrastructure have not been observed because the site is no longer reachable.

Consequently, the full scope of the campaign remains uncertain. Defenders should continue to block the domain at the DNS and proxy layers, monitor for any traffic to the IP address 142.250.186.132, and update web‑filter and intrusion‑prevention signatures that reference the observed indicators. Because the registrar is Dynadot, threat‑intel teams may consider requesting additional registration details from the registrar to support takedown or attribution efforts. Ongoing vigilance for newly registered domains that reuse the same sub‑domain pattern or host on the same Cloudflare nameservers is advised.