wct[.]airdrpsalert[.]sbs

This domain, wct.airdrpsalert.sbs, was registered on 22 October 2025 through Dynadot LLC. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. DNS resolution points to the IPv6 address 2607:f8b0:4004:c07::93, which is announced by AS15169, the Google LLC network, placing the host in the United States. No TLS certificate is presented for the site, meaning HTTPS is not available. The page title returned from the site is “Google”, and the intelligence explicitly marks the domain as impersonating the Google brand.

VirusTotal analysis shows that ten of ninety‑five security vendors flagged the domain, suggesting malicious intent. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy service. Current HTTP status is reported as offline, so the site is not presently reachable. The available evidence confirms that the infrastructure is deliberately crafted to resemble a legitimate Google resource while lacking proper security controls such as SSL.

The detection count and blocklist inclusion demonstrate that security vendors have identified the domain as malicious. However, because the site is offline, the exact content, payload, or credential‑harvesting mechanisms cannot be verified at this time. Defenders should continue to block the domain at network perimeter and DNS filtering layers, add the IPv6 address to host‑based deny lists, and monitor for any re‑activation or new subdomains using the same registrar or nameservers. Ongoing vigilance is advised, especially for users who may receive emails referencing the “Google” page title, as the domain may be re‑used in future impersonation campaigns.