wlfi[.]airdropsalert[.]xyz

This domain, wlfi.airdropsalert.xyz, was created on 17 October 2025 and is listed as a Google brand impersonation that delivers a crypto‑scam payload. The site was registered through Dynadot LLC and is hosted on an IP address (142.251.140.164) owned by Google LLC (AS15169) in the United States. DNS resolution points to Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the attacker leveraged Cloudflare’s DNS service. No HTTPS certificate is present, meaning the site could only be accessed via plain HTTP before it was taken offline.

The page title returned “Google”, matching the claimed brand target, and the Gridinsoft trust score is 0 / 100, confirming a lack of legitimacy. VirusTotal scans show nine of ninety‑five security vendors flag the domain, and the domain appears on one public blocklist. PhishDestroy has already blocked the domain and reports its status as offline. The limited detection footprint suggests the site was short‑lived, but the combination of a recent registration date, Cloudflare name‑server usage, and a Google‑owned IP indicates a deliberate attempt to increase credibility.

Defenders should add wlfi.airdropsalert.xyz to local deny lists, monitor traffic to the associated IP for any residual activity, and watch for newly registered domains that resolve to the same Cloudflare name servers or reuse the “airdropsalert.xyz” sub‑domain pattern. Because the site is currently offline, active mitigation is limited to preventive blocking and continued intelligence sharing. Continued observation of the registrar Dynadot for similar registrations may reveal future campaigns targeting Google users with crypto‑related scams.