threshold[.]airdrpsalert[.]cfd

The domain threshold.airdrpsalert.cfd was registered on October 22, 2025 through Dynadot LLC and currently resolves to the IP address 142.250.185.100, which is owned by AS15169 Google LLC in the United States. The domain is hosted on Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, indicating the site is served over plain HTTP. The only visible HTML element reported is the page title “Google,” matching the declared brand target of Google and confirming the classification as a brand‑impersonation attempt.

The domain has been placed on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal scans show that 11 of 95 AV engines flagged the domain, reflecting a moderate detection rate. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed as offline at the time of analysis. The evidence points to an infrastructure that leverages legitimate Google IP space, possibly to increase credibility, while lacking SSL and relying on Cloudflare DNS.

Uncertainty remains regarding the exact content served before takedown, as no page content beyond the title has been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for re‑registration attempts, and add the domain to internal threat‑intel feeds. Ongoing observation of the associated IP and ASN is advised to detect any future abuse originating from the same host.