fil[.]airdrpsalerts[.]sbs

Analysis of the domain fil.airdrpsalerts.sbs indicates it was actively impersonating Google, as evidenced by its page title ('Google') and its classification as a brand impersonation scam. Registered on October 29, 2025, through Dynadot LLC, the domain has since been taken offline, though it remains flagged by security vendors and blocklists. As of July 23, 2026, 12 of 95 security vendors on VirusTotal detect this domain as malicious, and it appears on at least one security blocklist (PhishDestroy). Infrastructure analysis reveals the domain resolved to the IP address 142.250.176.196, which is geolocated in the United States and associated with AS15169 (Google LLC).

However, this IP resolution is anomalous, as the domain lacks an SSL certificate and was not hosted on Google infrastructure, suggesting possible DNS misconfiguration or spoofing. Nameservers point to Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. The absence of an SSL certificate further increases suspicion, as legitimate brand domains typically enforce HTTPS. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification.

While the domain is currently offline, defenders should treat any future resolution or re-registration as a potential threat. Organizations are advised to block the domain at the DNS level, monitor for related subdomains or typosquatting variants, and alert users to the risk of Google-branded phishing campaigns originating from this infrastructure. The exact content or phishing kit used remains unconfirmed due to the domain's offline status.