bnc[.]airdrpsalerts[.]life

The domain bnc.airdrpsalerts.life is flagged as a high‑risk Google impersonation campaign. DNS resolution returns the IPv4 address 216.58.206.68, which belongs to AS15169 Google LLC and is geolocated to Germany. The site presents a page title of "Google" and serves over Cloudflare infrastructure with HTTP/3 enabled, but the HTTP response currently returns a 502 error. SSL handshake is completed with a certificate issued by Google Trust Services under the WE1 designation, confirming legitimate‑looking TLS parameters despite the malicious purpose.

The domain is listed on one security blocklist and is actively blocked by PhishDestroy. VirusTotal scans show that ten of ninety‑five AV engines flagged the domain, indicating detected malicious activity. Registration information shows the domain is sponsored by Cloudflare, Inc., and the nameserver query returned NS_NOT_FOUND, suggesting possible obfuscation.

While the presence of a valid Google certificate and the use of Cloudflare may lend an appearance of legitimacy, the combination of brand impersonation, blocklist presence, and multiple vendor detections confirms the malicious nature. Defenders should add the domain to URL filtering policies, enforce blocklists that include it, monitor outbound connections to the associated IP, and consider raising alerts for any authentication attempts to Google‑related services originating from this host. Continuous re‑evaluation is advised, as the site’s status remains active and the underlying infrastructure could be reused for further credential‑harvesting campaigns.