fuel[.]airdrpsalerts[.]lol

fuel.airdrpsalerts.lol was observed resolving to the IP address 142.250.185.164, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The domain was registered on October 29, 2025 through Dynadot LLC and is served by the Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was presented when the host was queried, indicating the site was delivered over plain HTTP. The page title returned by the server is “Google”, matching the declared brand target and confirming the intent to impersonate the search giant.

VirusTotal scans recorded four positive detections out of ninety‑five submitted engines, and the domain appears on a single public blocklist. Gridinsoft assigned a trust score of zero out of one hundred, and PhishDestroy has listed the domain as blocked. The site is currently taken offline, and no further content was captured. Analysis indicates that the infrastructure leverages a legitimate Google IP range, a technique that can bypass some IP‑based reputation filters.

The use of Cloudflare DNS suggests the operators sought resiliency and obscured the true origin of the domain. The absence of TLS and the low trust score reinforce the malicious nature of the site, despite the limited number of blocklist entries. Defenders should continue to block the domain at DNS and proxy layers, monitor for resurgence of the same host name or similar sub‑domains, and add the observed indicators—IP 142.250.185.164, the two Cloudflare name servers, the Dynadot registrar, and the “Google” page title—to threat‑intel feeds. Ongoing observation of VirusTotal and other multi‑engine scanners is recommended to capture any changes in detection ratios.