threshold[.]app-airdropalert[.]lol

Analysis of threshold.app-airdropalert.lol, observed as offline as of the report date, shows a domain created on 10 November 2025 through Dynadot LLC. The domain resolves to IP 142.250.185.164, which belongs to AS15169 Google LLC in the United States, indicating the use of legitimate Google infrastructure for hosting. No TLS certificate was presented, leaving the site reachable only over HTTP. The page title returned "Google", and the domain is classified as a brand‑impersonation campaign targeting Google. The associated scam type is listed as a crypto scam.

Infrastructure data reveal the authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming Cloudflare DNS services. Detection metrics indicate that 15 of 95 security vendors on VirusTotal flagged the domain, and it appears on a single public blocklist. The domain was blocked by PhishDestroy and received a Gridinsoft trust score of 0 out of 100. The lack of SSL, combined with a low trust score and multiple vendor detections, suggests a high likelihood of malicious intent.

Current visibility shows the site has been taken offline, but the persistence of the infrastructure—particularly the use of a Google‑owned IP address—may enable rapid re‑hosting. Defenders should continue to monitor the domain and associated IP address for re‑activation, enforce DNS‑level blocks using the identified Cloudflare nameservers, and add the IP to network‑level deny lists. Users should be warned that any unsolicited communication referencing "Google" from this domain is unauthenticated and likely part of a crypto‑scam impersonation campaign. Ongoing threat‑intel feeds should be consulted for any new indicators tied to this seed.