plume[.]airsdropsalert[.]lol

The domain plume.airsdropsalert.lol was registered through Dynadot LLC on November 05, 2025 and is presently taken offline. DNS resolution points to IP address 172.253.62.104, which is announced by AS15169 (Google LLC) and located in the United States. The absence of an SSL certificate indicates that the site was reachable only via HTTP, a characteristic often observed in short‑lived impersonation campaigns. The page title returned by the server is "Google," matching the declared brand target and confirming the intent to masquerade as the well‑known search provider.

VirusTotal analysis recorded eight detections out of ninety‑five scanning engines, demonstrating that multiple security products identified the domain as malicious. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low confidence in the site’s legitimacy. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy feed, providing additional evidence of its abusive nature. Nameserver configuration uses Cloudflare’s brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common choice for rapid deployment of phishing infrastructure.

While the available intelligence confirms brand impersonation and malicious classification, the exact content served, such as credential‑stealing forms or redirect behavior, remains unknown because the site is no longer reachable. Defenders should continue to deny any network traffic to plume.airsdropsalert.lol and to its resolved IP address, add the domain to internal blocklists, and monitor for any resurgence of the same IP or similar Cloudflare nameserver patterns. Ongoing vigilance for related registrations using the same registrar or similar naming schemes is recommended to pre‑empt future impersonation attempts.