euler[.]airdrpsalert[.]lol

Analysis of the domain euler.airdrpsalert.lol, observed on July 25, 2026, indicates a Google brand impersonation campaign that has been taken offline. The domain was registered on October 22, 2025 through Dynadot LLC and is hosted on Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP address 142.251.35.164, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. No TLS certificate was present at the time of inspection, suggesting the site was served over plain HTTP.

The page title returned by the server was simply “Google”, matching the declared brand target. VirusTotal records show that nine out of ninety‑five scanning engines flagged the domain as malicious, and the site appears on at least one public security blocklist. Independent reputation services assigned extremely low trust scores: Gridinsoft rated it 0 out of 100 and Scamadviser gave a score of 1 out of 100. The domain has been reported to and blocked by the PhishDestroy mitigation service.

Because the site is currently offline, active payloads cannot be verified, and the exact phishing kit or landing page content remains unknown. Defenders should continue to monitor the IP address 142.251.35.164 for any resurgence of malicious activity, enforce outbound filtering for the domain name and its sub‑domains, and ensure that users are warned against unsolicited communications that reference a Google login. Adding the domain to internal blocklists and sharing the indicator with threat‑intel sharing platforms will help prevent future abuse. The limited evidence suggests a short‑lived impersonation attempt that leveraged a legitimate‑looking Google IP to increase credibility.