plumenetwork[.]airdropsalert[.]biz

The domain plumenetwork.airdropsalert.biz was registered on 2025-10-18 through Dynadot LLC and is presently taken offline. DNS resolution points to IP 64.233.180.99, which belongs to AS15169 Google LLC and is geolocated in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. No TLS certificate was observed, and the HTTP service returned no content because the site is offline, limiting direct content analysis.

The page title returned by the server, when it was reachable, was “Google”, matching the declared brand target of Google and confirming a brand‑impersonation tactic. VirusTotal recorded 13 detections out of 95 scanned scanners, and the domain appears on at least one public security blocklist. PhishDestroy has already blocked the domain. The listed scam type is “Crypto Scam”, suggesting that any payload or lure would have involved cryptocurrency‑related promises or requests.

Because the site is no longer active, investigators cannot verify the exact landing page or malicious payload, and the lack of an SSL certificate prevents assessment of certificate‑based trust signals. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑use of the same IP address or nameserver configuration, and add the domain to internal threat‑intel feeds. Ongoing observation of related Cloudflare nameservers and the IP address is advisable, as adversaries often recycle infrastructure. The combination of brand impersonation, cryptocurrency lure, modest detection rate, and the use of reputable hosting underscores an elevated risk profile despite the current offline state.