dot[.]airdrpalert[.]click

Analysis of dot.airdrpalert.click shows a domain registered through Dynadot LLC on October 30, 2025 that is currently taken offline. The site presented a page title of "Google" and is classified as a brand impersonation campaign targeting Google. Infrastructure inspection reveals that the domain resolves to IP address 142.250.185.164, which belongs to AS15169 Google LLC and is located in the United States, indicating use of a legitimate Google IP range to increase credibility. No TLS certificate was observed, meaning the site served HTTP only, which further lowers the trustworthiness of the connection.

The domain carries a Gridinsoft trust score of 0 out of 100 and appears on a single security blocklist, reflecting a very low reputation among static reputation services. VirusTotal analysis recorded three detections out of ninety‑five scanned vendors, confirming that multiple security products have identified malicious activity associated with the domain. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com are Cloudflare‑based, a common choice for fast DNS updates and potential abuse. The domain has been blocked by PhishDestroy, indicating that at least one dedicated anti‑phishing service has taken remediation action.

Uncertainty remains regarding the exact payload or credential‑stealing mechanisms because no page content or HTTP response details were captured before the takedown. Defenders should continue to monitor for any resurgence of the domain or similar sub‑domains, enforce strict URL filtering for the exact hostname, and consider adding the domain to internal blocklists. Additional threat‑intel feeds should be queried for any related command‑and‑control infrastructure, and any observed traffic to the associated IP should be inspected for anomalous patterns, even though the IP belongs to a legitimate cloud provider.