polymarket[.]airdrpsalerts[.]xyz

Analysis of polymarket.airdrpsalerts.xyz confirms it as a phishing domain impersonating Google, operational until its recent takedown. The domain was registered on November 4, 2025, through Dynadot LLC and resolved to the IP address 142.250.186.132, which is associated with AS15169 (Google LLC) in the United States. Despite the IP's legitimate ownership, the domain itself was flagged for brand impersonation, with a page title explicitly set to 'Google,' reinforcing its fraudulent intent. No SSL certificate was detected, increasing the likelihood of interception or tampering during data transmission.

Infrastructure analysis reveals the domain was hosted behind Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure origin servers and evade detection. At the time of assessment, the domain appeared on one security blocklist (PhishDestroy) and was flagged by 15 of 95 security vendors on VirusTotal, indicating moderate consensus among detection engines. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The domain is currently offline, though defenders should monitor for potential reactivation or migration to new infrastructure.

Defenders are advised to treat this domain as confirmed malicious and update blocklists accordingly. Given the use of Cloudflare and the absence of SSL, network-level protections (e.g., DNS filtering, IP-based blocking) should be prioritized over reliance on certificate transparency logs. The exact content of the phishing page remains unanalyzed, but the combination of brand impersonation, low trust scores, and vendor detections justifies elevated scrutiny. Historical WHOIS and passive DNS data may provide additional pivot points for identifying related campaigns.