defiapp[.]airsdropsalert[.]lol

The domain defiapp.airsdropsalert.lol was registered on November 5, 2025 through Dynadot LLC and is currently marked as taken offline. DNS resolution points to IP address 142.250.186.68, which belongs to the AS15169 Google LLC network and is geolocated in Germany. The site presented a page title of "Google" and is classified as a crypto‑related scam that impersonates Google, matching the brand target indicated in the intelligence feed. No SSL certificate was observed, leaving the HTTP service unencrypted and exposing any traffic to interception.

Reputation checks show that 15 of 95 security vendors on VirusTotal flagged the domain, and it appears on a single external blocklist, where PhishDestroy has already listed it as malicious. The Gridinsoft trust score of 0 out of 100 further underscores a lack of legitimacy. Nameserver records list brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS infrastructure, a common choice for fast deployment of malicious sites. While the domain resolves to a Google‑owned IP block, the lack of a valid TLS certificate and the presence of brand‑impersonating page title indicate deliberate abuse of the host’s reputation to lure victims, likely for cryptocurrency fraud.

Uncertainty remains around the exact content served before takedown, as no live HTTP response or page snapshot is available. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP for any future abuse, and add the domain to internal threat‑intel feeds. Incident responders should verify that no internal users accessed the site while it was active, and if any credentials or crypto wallet details were submitted, initiate appropriate containment and credential rotation procedures.