flx[.]airdrpsalerts[.]click

Analysis of the domain flx.airdrpsalerts.click indicates it was actively engaged in credential phishing targeting Google users. The domain, created on February 21, 2026, resolved to the IP address 192.178.155.103, hosted under AS15169 (Google LLC) in the United States. Despite the hosting infrastructure association with Google, the domain itself was flagged for brand impersonation, specifically mimicking Google, as evidenced by the page title 'Google' and its classification as a credential phishing scam. The domain has since been taken offline, though its prior activity was detected and blocked by PhishDestroy, and it appears on at least one security blocklist.

Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk classification. VirusTotal scans identified the domain as malicious by 2 of 95 security vendors, though this represents a limited detection scope. The SSL certificate was issued under the identifier WR2, which does not provide additional trust indicators.

Defenders should treat this domain as a confirmed phishing threat, particularly for credential harvesting targeting Google services. Historical resolution data, SSL certificate details, and detection timestamps should be incorporated into threat intelligence feeds to prevent future access or re-emergence. No additional page content or phishing kit details are currently available for further classification.