astr[.]airdrpsalerts[.]click

Analysis of the domain astr.airdrpsalerts.click indicates it was actively involved in brand impersonation targeting Google, as documented on July 23, 2026. The domain, registered through Dynadot LLC on November 4, 2025, resolved to the IP address 142.250.181.228, which is geolocated in the United States and associated with AS15169 (Google LLC). However, infrastructure analysis reveals no direct affiliation with Google, as the domain was hosted behind Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and lacked an SSL certificate, increasing susceptibility to interception or tampering. The page title captured from the domain was 'Google,' aligning with the reported scam type of brand impersonation.

Detection data shows the domain appeared on one security blocklist (PhishDestroy) and was flagged by 15 of 95 security vendors on VirusTotal, confirming its malicious classification. Gridinsoft assigned a trust score of 0/100, further corroborating its high-risk status. At the time of reporting, the domain was offline, though its prior operational state and detection history suggest it was part of a phishing campaign designed to deceive users into believing they were interacting with legitimate Google services. Defenders should treat this domain as compromised infrastructure.

While the exact content of the phishing page remains unanalyzed, the combination of a Google-branded page title, Cloudflare hosting, and absence of SSL certificates is consistent with credential harvesting or malware distribution tactics. Network security teams are advised to block the domain at the DNS and proxy levels, monitor for related subdomains or IP reuse, and review logs for prior connections to 142.250.181.228 or the Cloudflare nameservers. Given the domain's registration age and detection history, it may resurface under altered infrastructure; vigilance for similar patterns (e.g.