sym[.]airdropsalert[.]us

Analysis of the domain sym.airdropsalert.us indicates elevated risk due to confirmed brand impersonation targeting Google. The domain was registered on October 18, 2025, through Dynadot LLC and resolves to the IP address 142.251.41.164, which is associated with AS15169 (Google LLC) in the United States. This alignment with Google’s infrastructure may have been exploited to lend credibility to the phishing operation, though the hosting context remains unverified. Nameservers are provided by Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure origin and evade takedowns.

The domain lacks an SSL certificate, increasing susceptibility to interception and reducing user trust signals. The page title, explicitly labeled 'Google,' corroborates the brand impersonation claim. Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist. PhishDestroy has flagged it as malicious, and 12 of 93 security vendors on VirusTotal detect it as harmful, though the absence of additional context limits attribution to a specific threat actor or campaign.

The scam type is classified as a crypto scam, though no further details about the mechanics or payload are available. The domain was taken offline by the report date of July 23, 2026, but residual risk persists for users who may have interacted with it prior to deactivation. Defenders should monitor for related domains registered under the same registrar or utilizing identical nameserver patterns, particularly those leveraging Cloudflare or resolving to Google-owned IP ranges. Network-level blocking of 142.251.41.164 is recommended where feasible, alongside user education regarding crypto-related phishing lures impersonating major brands.