bnc[.]airdrpsalert[.]life

This domain, bnc.airdrpsalert.life, was observed hosting a page whose title is exactly "Google", indicating a direct brand impersonation of Google. The site does not present an SSL certificate, and DNS queries return no nameserver information (NS_NOT_FOUND). The domain resolves to the IPv6 address 2a00:1450:4001:80f::2004, which belongs to the network of Google LLC (ASN 15169) located in Germany. Registration was performed through Cloudflare, Inc., a common privacy‑preserving registrar.

The domain has been added to a single security blocklist and is currently listed by PhishDestroy as offline. Reputation services assign extremely low trust scores: Gridinsoft scores 0 / 100 and Scamadviser 1 / 100. VirusTotal analysis shows that 11 of 95 scanned security vendors flagged the domain, confirming malicious activity. The combination of a brand‑matching page title, lack of TLS, and low reputation scores aligns with the classified scam type of brand impersonation.

At present, the exact content served by the site has not been captured, and the absence of a public HTTP status leaves the response behavior uncertain. Defenders should continue to block the domain at network perimeter, monitor for any re‑registration attempts, and consider adding the IPv6 address to internal deny lists. Because the hosting infrastructure resides within Google’s own ASN, any future relocation could evade simple IP‑based filtering, so threat‑intel feeds should be consulted for updated indicators. Continuous observation of Cloudflare‑registered domains targeting Google is recommended to detect similar campaigns early.