dbr[.]airdrpsalerts[.]sbs

This domain, dbr.airdrpsalerts.sbs, was observed hosting a brand‑impersonation campaign targeting Google. The domain was registered on 29 October 2025 through Dynadot LLC and is configured to use Cloudflare authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP address 142.250.185.132, which belongs to AS15169 operated by Google LLC and is located in the United States. The use of a Google‑owned IP suggests the campaign leveraged legitimate infrastructure, possibly to increase credibility and evade simple IP‑based blocking.

No TLS certificate was presented at the time of analysis, indicating the site served only over HTTP. The page title returned by the server is "Google," confirming the intent to masquerade as the legitimate brand. Infrastructure reputation is extremely poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, specifically PhishDestroy. VirusTotal analysis recorded 14 detections out of 95 scanned vendors, reflecting moderate consensus among security products.

The domain is currently offline, so active exploitation cannot be confirmed, but historical evidence shows it was used for brand impersonation. Defenders should add dbr.airdrpsalerts.sbs to blocklists at both DNS and proxy layers, enforce HTTPS‑only policies that reject unencrypted connections to this host, and monitor for any resurgence of activity from the associated IP range. Further investigation of any related sub‑domains or similar Cloudflare‑resolved hosts is advised, as the attacker may reuse the same infrastructure for future campaigns.