momentum[.]airdropalerts[.]bond

The domain momentum.airdropalerts.bond was observed on October 14 2025 via Dynadot LLC registration. It resolves to IP 142.250.186.36, which belongs to AS15169, Google LLC, located in the United States. The hosting appears to be provided by Google infrastructure despite the domain's use of Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was presented, indicating the site was served over HTTP only. The page title returned was "Google", and the site explicitly impersonates the Google brand, employing a fake‑airdrop narrative as indicated by the scam type "Fake Airdrop".

Security monitoring services have taken action: PhishDestroy listed the domain as blocked, and it appears on a single external blocklist. VirusTotal analysis recorded 11 of 95 scanners flagging the domain as malicious, reinforcing the suspicion of credential‑stealing or malicious distribution activity. The site has since been taken offline, but the artifacts remain useful for threat hunting. Uncertainty remains around the exact payload delivered to victims, as no sample URLs or download content have been published.

No TLS certificate means interception of traffic would be feasible, yet the offline status limits immediate observation of malicious code. Defenders should add the domain and its resolving IP to inbound and outbound allow‑list exclusions, monitor for any residual DNS queries, and flag any HTTP requests to 142.250.186.36 that contain Google‑related parameters. Correlation with the known blocklist entry and the PhishDestroy feed can help identify related campaigns that reuse the same infrastructure or naming pattern. Continuous re‑scanning of the IP and any future look‑ups for the domain are recommended to catch potential re‑hosting attempts.