fil[.]airsdropsalerts[.]sbs

The domain fil.airsdropsalerts.sbs was registered through Dynadot LLC on 07 November 2025. It resolves to the IPv4 address 142.251.140.164, an address that belongs to AS15169 Google LLC and is geolocated in the United States. The domain is currently listed as taken offline, and no TLS certificate is presented for the host, indicating that HTTPS connections are not available. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both operated by Cloudflare. A page request returned the title “Google”, matching the declared brand target of Google and the scam classification of brand impersonation.

Gridinsoft assigned a trust score of 0 out of 100, and the site appears on a single security blocklist that is actively enforced by PhishDestroy. VirusTotal analysis shows that 11 of 95 scanning engines flagged the domain, reflecting a moderate level of detection across the security community. The combination of a legitimate Google‑owned IP address, absence of SSL, and a generic page title suggests an attempt to exploit the reputation of the underlying host while avoiding the overhead of certificate provisioning. Evidence gaps remain: the actual HTTP response body has not been captured, so the presence of credential‑stealing forms or redirect behavior cannot be confirmed. No Safe Browsing or Open Threat Exchange identifiers have been reported for this host, and no additional infrastructure such as command‑and‑control servers or phishing kits has been linked.

Consequently, the full scope of the campaign cannot be quantified. Defenders should proactively block fil.airsdropsalerts.sbs at the DNS level and consider adding the IP 142.251.140.164 to network‑level deny lists, especially for traffic targeting Google services. Monitoring of the domain’s registration and DNS records is advised, as adversaries may reactivate the host or migrate the payload to a new subdomain.