aethir[.]airdropalert[.]us

On July 24, 2026 analysts observed that the domain aethir.airdropalert.us was actively used to impersonate Google. The site presented a page title of "Google," matching the declared brand target. DNS resolution points to IP address 192.178.155.103, which is registered to AS15169, Google LLC, and geolocated in the United States. The domain lacks an SSL certificate, exposing any traffic to clear‑text interception. Registration information shows the domain was created on October 19, 2025 through Dynadot LLC, and the authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare's DNS service.

Google Safe Browsing has flagged the URL for social engineering, and PhishDestroy has listed the domain as blocked. The site also appears on a single external security blocklist, and VirusTotal reports that 11 of 93 scanning engines have marked the domain as malicious. The listed scam type is a crypto scam, though the specific payload or transaction vectors have not been publicly disclosed. Current status is offline, suggesting the operators have taken the site down, possibly in response to takedown actions.

Uncertainty remains around the exact content served prior to shutdown, the presence of any additional infrastructure such as command‑and‑control servers, and whether the domain was leveraged for phishing credential collection or cryptocurrency theft. Defenders should continue to block the domain and associated IP at perimeter defenses, monitor for re‑registration attempts, and add signatures for the observed hostnames and Cloudflare name servers to intrusion detection systems. Continuous observation of the IP range owned by AS15169 for anomalous traffic patterns is advised, as is reviewing any outbound connections from internal hosts to the domain during its active window. Updating URL filtering lists with the confirmed indicators will help mitigate residual risk from similar impersonation campaigns.