mole[.]airdropalerts[.]icu

This domain, mole.airdropalerts.icu, was registered on 14 October 2025 through Dynadot LLC. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS services. DNS resolution points to IP address 216.58.206.36, which belongs to AS15169 Google LLC and resolves to a location in Germany. The same IP is used by legitimate Google services, and the site presents a page title of “Google,” matching the declared brand target. No TLS certificate was observed, meaning the site was served over plain HTTP at the time of analysis. The content classification is a “Fake Airdrop” campaign that attempts to impersonate Google, consistent with the brand‑target field.

VirusTotal recorded 12 detections out of 95 scanned engines, and the domain appears on a single security blocklist. PhishDestroy has already taken the domain offline, and the current status is reported as offline. The combination of a newly created domain, Cloudflare name servers, and the reuse of a Google‑owned IP suggests an attempt to gain credibility through IP reputation rather than hosting the malicious payload directly. The lack of an SSL certificate reduces confidence for users, but the deceptive use of the Google brand in the page title may still lure victims. Uncertainty remains regarding the exact payload delivered to victims because the site was taken down before a full content capture could be performed.

Additionally, it is not clear whether the domain was part of a larger campaign infrastructure or a one‑off test. Defenders should continue to block the domain at DNS and network layers, monitor for any resurgence of the same hostnames or similar Cloudflare name server pairings, and add the domain to internal blocklists. Threat‑intel feeds should be updated with the registration date, registrar, and IP association to improve future detection of copycat campaigns that reuse reputable IP ranges.