zircuit[.]airdrpsalert[.]lol

The domain zircuit.airdrpsalert.lol was registered on October 22, 2025 through Dynadot LLC and is presently taken offline. DNS resolution points to the IPv6 address 2607:f8b0:4004:c21::63, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No SSL certificate was observed during the scan, and the HTTP response returned a page title of "Google," matching the declared brand target.

The site is classified as a brand impersonation campaign targeting Google, and security vendors have flagged it as malicious: 13 of 95 vendors on VirusTotal reported detections. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed. Independent scoring by Gridinsoft assigned a trust score of 0 out of 100, reinforcing its malicious reputation.

Although the site is no longer reachable, the infrastructure indicators—such as the Google‑owned IP range, Cloudflare name servers, and lack of TLS—provide concrete evidence of an attempt to masquerade as a legitimate Google service. Defenders should ensure that any residual DNS or caching artifacts are purged, add the IPv6 address and the fully qualified domain name to network‑level block lists, and monitor for any re‑registration attempts. Updating web filtering solutions with the observed indicators and reviewing outbound traffic for connections to the identified IP block can mitigate the risk of accidental exposure should the domain be resurrected or reused in future campaigns.