soniclabs[.]airdropalert[.]us

Analysis of soniclabs.airdropalert.us indicates this domain is a confirmed crypto scam impersonating Google, currently offline as of July 23, 2026. The domain was registered on October 19, 2025, through Dynadot LLC and resolves to IP address 192.178.155.99, hosted under AS15169 (Google LLC) in the United States. Infrastructure analysis reveals Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a configuration often used to obscure hosting origins. No SSL certificate is present, increasing the risk of unencrypted data interception. The page title 'Google' directly matches the impersonated brand, aligning with the reported scam type.

Security vendor detections on VirusTotal show 14 of 93 engines flagging the domain, a significant indicator of malicious activity. The domain appears on one security blocklist and is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. While the domain is currently offline, defenders should treat it as active threat infrastructure.

Organizations are advised to block the domain, IP, and associated nameservers at the perimeter. Monitor for re-registration or shifts to new IPs under the same registrar. Given the use of Cloudflare, additional scrutiny of domains sharing these nameservers is recommended. The exact content and mechanics of the scam remain unconfirmed, but the available evidence supports immediate defensive action.