recall[.]airdropsalert[.]app

The domain recall.airdropsalert.app is currently offline but was previously registered through Cloudflare, Inc. and configured with missing nameserver data (NS_NOT_FOUND). DNS resolution points to IP address 142.250.185.228, an address owned by AS15169 Google LLC located in the United States. The lack of an SSL certificate indicates that any traffic to the site would have been unencrypted, a common characteristic of malicious landing pages. The page title returned from the host was "Google," aligning with the declared brand target of Google and confirming the intent to impersonate the well‑known brand.

The scam type is identified as a crypto scam, suggesting that the site likely attempted to lure victims into sending cryptocurrency under the pretense of a legitimate Google‑related offering. Threat intelligence shows that 16 of 95 VirusTotal scanning vendors flagged the domain, and the site appears on one external security blocklist. PhishDestroy has explicitly blocked the domain, and Gridinsoft assigned a trust score of 0 / 100, indicating a high confidence of malicious behavior. While the IP address belongs to Google’s infrastructure, the use of a legitimate hosting provider does not mitigate the observed indicators of wrongdoing.

Uncertainty remains regarding the exact content that was served before the takedown, as no SSL certificate or HTTP status code is available for analysis. Defenders should continue to block recall.airdropsalert.app at the DNS and network layers, monitor for any re‑registration attempts, and apply brand‑specific detection rules for Google‑impersonation campaigns. Ongoing vigilance is recommended given the combination of brand impersonation, crypto‑scam classification, and multiple vendor detections.