zircuit[.]airdrpsalert[.]sbs

Analysis of the domain zircuit.airdrpsalert.sbs indicates a brand‑impersonation campaign targeting Google. The domain was registered through Dynadot LLC on 22 October 2025 and resolves to the IP address 142.250.186.164, which belongs to AS15169 (Google LLC) and is geolocated in the United States. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both operated by Cloudflare. No TLS certificate was observed, and the HTTP response returned a page whose title is simply “Google”, matching the declared brand target.

The site has been taken offline as of the reporting date, 22 July 2026, and is currently listed on the PhishDestroy blocklist. VirusTotal scans show three of ninety‑five security vendors flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The limited visibility of the site prevents confirmation of the exact content or credential‑harvesting mechanisms, and no additional intelligence such as Safe Browsing or OTX references is available.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same host or IP, and add the domain to internal blacklists. Because the IP belongs to Google’s infrastructure, any future use of the same address should be scrutinized for potential abuse of legitimate services. Ongoing threat‑intel feeds should be consulted for possible re‑registration or related indicators of compromise.