mole[.]airdropalert[.]us

Analysis of mole.airdropalert.us shows a clear infrastructure pattern consistent with a brand‑impersonation crypto scam targeting users of Google services. The domain was registered on October 19, 2025 through Dynadot LLC and is hosted on the IP address 192.178.155.99, which belongs to the Google LLC autonomous system (AS15169) in the United States. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate was observed, and the site is currently offline, which aligns with the reported status of being taken down.

The page title returned by the server is "Google", matching the declared brand target. VirusTotal scans have recorded 12 detections out of 93 security vendors, and the domain appears on one public blocklist. It has also been flagged by PhishDestroy and received a Gridinsoft trust score of 0 / 100, reinforcing the malicious assessment. The scam type is identified as a crypto scam, though no additional payload or transaction details are publicly available.

Defenders should immediately block the domain at network perimeters, add the IP address to threat intelligence feeds, and monitor for any future re‑registration attempts. Continuous observation of the associated Cloudflare name servers is advised, as they may be reused for related campaigns. Given the low trust score, multiple vendor detections, and confirmed brand impersonation, the domain should be treated as a high‑confidence malicious indicator.