beefy[.]airsdropsalert[.]lol

Analysis of the domain beefy.airsdropsalert.lol indicates a confirmed brand‑impersonation campaign targeting Google users. The domain was registered through Dynadot LLC on 5 November 2025 and is served by the Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP address 142.251.40.132, which belongs to AS15169 owned by Google LLC and is located in the United States. Despite the IP belonging to the legitimate Google network, the domain itself lacks an SSL certificate and presents a page title of “Google”, matching the declared target brand.

The site has been taken offline, and the threat‑intelligence feed PhishDestroy reports it as blocked. Gridinsoft assigns a trust score of 0 / 100, and eight of ninety‑five VirusTotal scanners flag the domain as malicious. The domain appears on one external blocklist and has been removed from active service. Current evidence does not reveal the exact content or payload delivered by the site, and no additional indicators such as hashes, URLs, or phishing kit signatures have been disclosed.

Defenders should immediately add beefy.airsdropsalert.lol to DNS and URL filtering policies, monitor for any re‑hosting of the same host name or similar sub‑domains, and treat traffic to the associated IP with heightened scrutiny despite its legitimate ownership. Continuous watching of Cloudflare name‑server patterns and registrations through Dynadot may reveal future campaigns that reuse this infrastructure. Because the site is offline, real‑time detection is limited, but historical indicators remain sufficient to justify proactive blocking and alerting of users who may receive emails referencing the domain.