hydration[.]airdrpsalerts[.]info

This domain, hydration.airdrpsalerts.info, was flagged for brand impersonation targeting Google, as indicated by the page title 'Google' and confirmed by multiple threat intelligence sources. Analysis reveals the domain is currently offline, with no active SSL certificate and nameservers marked as NS_NOT_FOUND. The domain resolved to IP 142.250.184.228, which is associated with AS15169 (Google LLC) in the US, though this does not confirm legitimacy due to potential IP spoofing or hijacking. Registration was conducted through Cloudflare, Inc., a common registrar for both legitimate and malicious domains.

Detection data shows 11 of 95 security vendors on VirusTotal flagged the domain, and it appears on at least one security blocklist, reinforcing its elevated risk classification. Defenders should note the absence of SSL encryption and the domain's prior association with a known brand impersonation scam. While the domain is currently offline, its infrastructure and registration details suggest it may have been part of a larger phishing campaign.

Organizations should monitor for related domains registered through Cloudflare or resolving to similar IPs, particularly those mimicking Google or other high-value brands. Blocking the domain at the DNS or proxy level is recommended as a precaution, even in its offline state, to prevent potential reactivation. No further details about the phishing kit or exact user interaction flow are available, as the site content was not analyzed prior to takedown.