usual[.]airdrpsalerts[.]lol

This domain, usual.airdrpsalerts.lol, was registered through Dynadot LLC on 29 October 2025. The zone is delegated to the Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented when the site is accessed, indicating that the service is delivered over plain HTTP. DNS resolution returns the IP address 142.250.185.68, which belongs to AS15169 owned by Google LLC and is geolocated in the United States.

The page title returned by the HTTP response is “Google”, matching the declared brand target of Google and confirming the intent to impersonate that brand. VirusTotal reports that six of ninety‑five scanning engines flag the domain, and the Gridinsoft trust score is 0 / 100, both indicating a high likelihood of malicious use. The domain appears on a single external blocklist, currently PhishDestroy, and has been taken offline according to the latest status information. The lack of an SSL certificate, combined with the low trust rating and multiple vendor detections, suggests the infrastructure was employed for brand‑impersonation campaigns rather than legitimate services.

Remaining uncertainties include the exact payload delivered after the initial landing page, the presence of any credential‑harvesting form, and whether the IP address was hijacked or intentionally used to lend legitimacy. Defenders should continue to block the domain at DNS and web‑gateway layers, monitor for any resurgence of the host name, and add the IP address to local deny lists pending further investigation. Continuous re‑evaluation of VirusTotal and other threat‑intel feeds is recommended to capture any new changes in detection status.