degen[.]airdrpsalert[.]cfd

On 23 July 2026 the domain degen.airdrpsalert.cfd was identified as a brand‑impersonation site that claims to represent Google. DNS resolution points to the IP address 142.250.184.228, which is owned by AS15169 Google LLC and is geographically located in the United States. The domain was registered on 22 October 2025 through Dynadot LLC, and its authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was presented during the brief connection attempt, indicating the service was delivered over unencrypted HTTP. The HTTP response contained the page title “Google”, directly matching the advertised brand target.

VirusTotal analysis shows that 13 of 95 scanned security vendors flagged the domain as malicious, reflecting a moderate consensus among scanners. The site is presently listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. Gridinsoft assigned a trust score of zero out of one hundred, and the overall risk rating was elevated. The current operational status is reported as offline, and the domain no longer resolves to active content. The observable evidence confirms the use of Google’s brand name without any legitimate affiliation, but the exact content delivered to victims—such as credential‑capture forms or malicious downloads—has not been captured, leaving that aspect of the attack vector unverified.

The lack of an SSL certificate, coupled with the use of Cloudflare name servers, suggests the operators relied on a low‑cost or disposable hosting configuration rather than compromising a legitimate Google‑owned host. Mitigation guidance recommends adding degen.airdrpsalert.cfd and its resolved IP address 142.250.184.228 to local deny‑lists and URL filtering policies. Security teams should monitor DNS queries for re‑appearance of the domain or related subdomains under the same registrar and name‑server pair.