send[.]airdrpsalerts[.]xyz

send.airdrpsalerts.xyz was registered on 2025-11-04 through Dynadot LLC. The domain resolves to 172.217.18.4, an address owned by AS15169 Google LLC located in the United States. Despite the IP belonging to Google’s infrastructure, the domain is not associated with any legitimate Google service; it lacks an SSL certificate and currently returns no HTTP response because the site has been taken offline. The nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS. The page title returned during the brief crawl was "Google", matching the declared brand target of Google and confirming the classification as a brand‑impersonation campaign.

Reputation services flag the domain severely: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 15 of 95 scanning engines label the host as malicious. The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy. The current offline status suggests the operators have removed the content, but the infrastructure artifacts remain observable.

Defenders should continue to block the domain at the DNS, proxy, and endpoint layers, monitor for any resurrection of the host, and consider adding the IP address to existing deny lists given its association with a known impersonation attempt. Ongoing intelligence collection should focus on any future re‑activation, TLS certificate requests, or changes to the hosting configuration that could indicate a new campaign. The available evidence does not reveal the specific payload or phishing kit employed, so additional sandbox analysis of any retrieved content would be required if the site becomes active again.