dot[.]airdrpsalert[.]sbs

dot.airdrpsalert.sbs was registered through Dynadot LLC on 22 October 2025. The domain resolves to the IP address 142.250.185.132, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. Despite the IP being owned by Google, the domain does not present a valid SSL certificate, leaving the HTTP connection unencrypted. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The site’s page title is simply “Google”, matching the declared brand target of Google and the scam classification of brand impersonation.

VirusTotal analysis recorded three positive detections out of ninety‑five scanners, and the domain is listed on PhishDestroy and one additional security blocklist. Gridinsoft’s trust scoring system assigned a score of 0 out of 100, reflecting a high confidence of malicious intent. The domain has been taken offline, and current status is reported as offline. Analysis confirms that the infrastructure leverages legitimate Google‑owned IP space, a tactic often employed to increase trust and bypass naive filtering.

The lack of TLS, combined with the low trust score and multiple vendor detections, indicates the domain was used for phishing or credential‑harvesting activities aimed at Google users. However, no publicly available screenshots or content samples have been captured, leaving the exact payload and landing page details unknown. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same hostnames or similar subdomains, and incorporate the observed indicators—domain name, registration date, IP address, name server pair, and detection counts—into threat‑intel feeds. Given the association with Google’s IP range, organizations relying on simple IP allow‑lists should consider adding context‑aware controls to prevent abuse of trusted ranges for malicious purposes.