scr[.]airdrpsalert[.]lol

Analysis of scr.airdrpsalert.lol indicates that the domain was registered on October 22 2025 through Dynadot LLC and resolves to the IP address 142.250.80.36, which belongs to AS15169 Google LLC located in the United States. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and it does not present an SSL certificate, causing HTTP connections to be unencrypted. The page title returned from the site is “Google”, matching the declared brand target and confirming a brand‑impersonation tactic aimed at Google. The site has been classified as a brand‑impersonation scam and was actively blocked by the PhishDestroy service. VirusTotal scans show that three out of ninety‑five security vendors flagged the domain, and the domain appears on one external blocklist.

Gridinsoft’s trust scoring system assigned a score of 0 out of 100, indicating a high likelihood of malicious intent. The domain’s current HTTP status is offline, and the threat intelligence feed marks it as taken offline. Evidence confirms that the infrastructure is hosted on Google’s network, which may be used to lend legitimacy to the malicious page. However, the lack of an SSL certificate and the low trust score suggest a hastily deployed operation.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no further content analysis or sandbox observation is available. Defenders should continue to block the domain at DNS and web‑proxy layers, monitor for any resurgence of the same hostnames or IP address, and add the domain to internal blocklists. Additional scrutiny of traffic to 142.250.80.36 and the associated Cloudflare nameservers is advisable, as is periodic re‑scanning on VirusTotal and other multi‑engine services to detect any changes in detection rates.