polymarket[.]airdropsalert[.]biz

On 23 July 2026, the domain polymarket.airdropsalert.biz was observed as offline but retained a record of malicious activity. The site was registered through Dynadot LLC on 18 October 2025 and uses Cloudflare authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP address 142.250.185.100, which belongs to AS15169 Google LLC and is geolocated in the United States. The absence of an SSL certificate indicates that the site was served over plain HTTP, a common characteristic of low‑effort impersonation campaigns.

The page title returned by the HTTP response is the literal string "Google", aligning with the declared impersonation of the Google brand. The domain is classified as a crypto‑scam, though the exact payload or lure has not been publicly disclosed. Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100, reflecting a high likelihood of malicious intent. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service.

VirusTotal analysis reports that 14 of 95 scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity. The combination of brand impersonation, low trust score, and multiple vendor detections suggests a credible threat vector targeting users seeking Google‑related services, potentially to harvest cryptocurrency credentials. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any resurgence of the domain or similar patterns. Further investigation is recommended to capture any associated command‑and‑control endpoints or phishing pages should the domain become active again.