send[.]app-airdropalert[.]sbs

Analysis of the domain send.app-airdropalert.sbs indicates a confirmed brand‑impersonation campaign targeting Google users with a crypto‑scam narrative. The site was registered on 10 November 2025 through Dynadot LLC and hosts its authoritative records on the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP address 142.250.185.132, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. Despite the legitimate‑looking IP, the domain lacks any TLS certificate, leaving the HTTP service unencrypted.

The page title returned by the web server is simply "Google," reinforcing the impersonation intent. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal analysis shows that 12 of 95 scanned security vendors flagged the domain as malicious, corroborating its classification as a crypto‑related scam. The threat has been actively blocked by the PhishDestroy mitigation service and is currently taken offline, indicating that the hosting infrastructure has been disrupted.

Defenders should continue to enforce blocklists that include this FQDN, monitor for any resurrection attempts on the same IP range or similar sub‑domain patterns, and apply DNS‑level filtering for requests to the associated Cloudflare name servers. Given the use of a Google‑owned IP address, additional scrutiny of outbound traffic to this address is advised to detect possible false‑positive legitimate Google services. Continuous review of new registrations under the "app‑airdropalert" label is recommended, as the naming convention may be reused in future impersonation attempts.