rls[.]airdrpsalerts[.]sbs

Analysis of domain rls.airdrpsalerts.sbs on July 23, 2026, reveals a high-confidence brand impersonation campaign targeting Google. The domain was registered on October 29, 2025, through Dynadot LLC and resolved to IP address 172.253.62.156, which is hosted on AS15169 (Google LLC) in the United States. Despite the benign hosting provider, the domain's page title is explicitly 'Google', and it has been flagged by 13 out of 95 security vendors on VirusTotal, indicating broad malicious consensus. The domain appears on 1 security blocklist and has been taken offline by PhishDestroy; however, the Gridinsoft trust score of 0/100 underscores sustained risk.

No SSL certificate was issued, suggesting the page lacked HTTPS encryption during operation. The nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com indicate use of Cloudflare's DNS infrastructure, which is legitimate but often abused for obfuscation. The presence of a specific brand impersonation (Google) in both the page title and threat classification confirms Google as the target. Defenders should note that while the domain is now offline, the registration through Dynadot and cloudflare hosting may be replicated in future campaigns.

Investigators should review DNS history for related subdomains and monitor for new registrations containing 'airdrpsalerts' or similar patterns, as well as check Safe Browsing and OTX for any logged redirect chains. The 13-detection count on VirusTotal is strong evidence of malicious intent, though the exact payload or landing page content remains unconfirmed. Recommended actions include blocking the domain at network level, adding the IP to blocklists even if it belongs to a reputable ASN, and reporting the registrar to Dynadot for abuse. No additional information about the campaign infrastructure, drop sites, or associated email addresses is available at this time.