airdropsalerts[.]art

Analysis indicates that the domain airdropsalerts.art was registered on 13 November 2025 through Dynadot LLC. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both associated with Cloudflare’s DNS service. DNS resolution points to IP address 142.250.186.164, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The lack of an SSL certificate means the site was served over plain HTTP, a characteristic often observed in low‑quality fraudulent deployments. The page title returned by the server is "Google", matching the declared impersonation target.

The domain is classified as a crypto‑scam type, and two of ninety‑five VirusTotal scanners flagged the site as malicious. PhishDestroy has added the domain to its blocklist, and it appears on one additional security blocklist. Gridinsoft’s trust score of 0 out of 100 further corroborates the malicious reputation. The site has been taken offline at the time of reporting, but the infrastructure artifacts remain observable.

Defenders should continue to block the domain and its associated IP address at network perimeter devices, update URL filtering feeds with the domain and its nameservers, and monitor for any re‑registration attempts. Given the association with Google’s IP range, any future use of the same address should be scrutinized for potential abuse. The combination of recent registration, Cloudflare DNS, absence of TLS, and low trust scores strongly suggests a deliberate brand‑impersonation campaign targeting users interested in cryptocurrency airdrops. Continuous vigilance is recommended.