sca[.]airdrpsalert[.]sbs

On 22 July 2026, sca.airdrpsalert.sbs was observed as an offline site that had been used for brand impersonation targeting Google. The domain was created on 22 October 2025 and registered through Dynadot LLC. DNS resolution points to 216.58.206.36, an address owned by AS15169 Google LLC and located in Germany, suggesting the attacker leveraged a legitimate Google IP range to increase credibility. The site presented the page title “Google” and was classified as a brand‑impersonation campaign. VirusTotal records show that three of ninety‑five scanned security vendors flagged the domain, indicating partial detection across the ecosystem.

It appears on a single security blocklist and has been explicitly blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, reflecting a highly suspicious reputation. No SSL certificate was observed, meaning the site operated without HTTPS, which is atypical for a domain using a Google‑owned IP block. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both hosted on Cloudflare’s infrastructure.

The evidence confirms that the domain was used to mimic Google, but because the site is currently offline, further behavioural analysis of the page content and payloads is not possible. Uncertainty remains regarding the exact phishing kit, any credential harvesting mechanisms, and whether the domain will be re‑activated. Defenders should continue to block the domain at perimeter and DNS layers, monitor for re‑registration or similar domains using the same registrar, and consider adding the associated IP address to watchlists despite its legitimate ownership. Ongoing vigilance against new domains that resolve to Google‑owned IP ranges and present brand‑specific titles is recommended.