sca[.]airdrpalert[.]click

Analysis indicates that the domain sca.airdrpalert.click was registered on 30 October 2025 through Dynadot LLC. The authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com resolve the domain to the IP address 172.217.18.4, which belongs to AS15169 Google LLC and is geolocated in the United States. The absence of an SSL/TLS certificate means the site operated over plain HTTP, and the page title returned by the server was “Google”, matching the declared brand‑impersonation objective. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation.

VirusTotal scanned the domain and reported three positive detections out of ninety‑five vendors, confirming malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. Current monitoring shows the site is offline, but the underlying IP is owned by Google and may be shared with legitimate services, so the indicator should be treated as a host‑based indicator rather than a persistent malicious server.

Defenders should add sca.airdrpalert.click to URL filtering rules, monitor DNS queries for the domain and its Cloudflare nameservers, and consider temporary blocking of the associated IP address while verifying that legitimate Google traffic is unaffected. Ongoing vigilance is recommended because the infrastructure—registered through a widely used registrar and hosted on a major cloud provider—can be rapidly re‑used for future impersonation campaigns targeting Google users. No SSL certificate, low trust score, and the brand‑impersonation page title collectively reinforce the elevated risk classification.