defiapp[.]airdrpsalert[.]click

The domain defiapp.airdrpsalert.click is a phishing site engaged in brand impersonation targeting Google, specifically designed to deceive users in a cryptocurrency scam. This site does not utilize a known drainer kit but poses an elevated risk by mimicking Google’s branding to trick victims into disclosing sensitive information or transferring cryptocurrency. As of the latest verification, defiapp.airdrpsalert.click has been taken offline, though prior activity indicates it was actively used for malicious purposes.

Technical analysis reveals that defiapp.airdrpsalert.click was flagged by 2 of 95 security vendors on VirusTotal, including ChainPatrol and SOCRadar, while appearing on 1 security blocklist (PhishDestroy). The domain was registered through Dynadot LLC on October 26, 2025, and resolved to the IP address 142.250.188.4, hosted on Google LLC’s infrastructure (AS15169). No SSL certificate was available, and the observed page title was 'Google'. The domain’s nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and Gridinsoft assigned it a trust score of 0/100.

Individuals who interacted with defiapp.airdrpsalert.click should immediately revoke any token approvals and transfer cryptocurrency to a new wallet to mitigate potential losses. If login credentials were entered, change passwords for the affected accounts and enable two-factor authentication. Report the phishing domain to Google’s Safe Browsing team, the registrar (Dynadot LLC), and relevant security platforms such as PhishTank or the Anti-Phishing Working Group to aid in takedown efforts.