recall[.]airdrpalert[.]click

This report analyzes the threat domain recall.airdrpalert.click, which was observed impersonating the Google brand. The site's page title was set to "Google," indicating an attempt to deceive users into believing they were interacting with a legitimate Google service. The identified scam type is Impersonation, meaning the site poses a threat by mimicking a trusted entity to potentially harvest credentials, distribute malware, or conduct phishing attacks.

Technical analysis reveals the domain was flagged by 8 out of 95 VirusTotal vendors, with detection from CRDF, CyRadar, ESET, Fortinet, and Seclookup. It is listed on one blocklist. The domain was registered on 2025-10-30 through registrar Dynadot LLC. It resolves to IP address 142.250.185.164, located in the United States and associated with AS15169 Google LLC. The domain uses nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No SSL certificate was detected, indicating a lack of encryption for any hosted content.

The domain is currently offline and down, as indicated by its status. The GridinSoft trust rating is 0 out of 100, reflecting a high level of risk. Although the site is not active at present, its registration data and impersonation of Google suggest it was created for malicious purposes. The risk level is assessed as high due to the impersonation of a major brand and the presence of multiple security vendor detections.