bob[.]airdrpsalerts[.]xyz

bob.airdrpsalerts.xyz was registered on 2025-11-04 through Dynadot LLC and is delegated to the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The domain resolves to the IP address 142.251.140.164, which belongs to AS15169 owned by Google LLC and is located in the United States. Despite hosting on a Google-owned address, the domain presents a page title of “Google” and is classified as a brand-impersonation campaign targeting Google. No TLS certificate was observed, meaning the site would be served over plain HTTP if reachable.

VirusTotal scans show that 14 of 95 security vendors have flagged the domain as malicious, indicating a moderate consensus of risk among detection engines. The domain appears on a single public blocklist and has been specifically blocked by the PhishDestroy feed, confirming that at least one anti‑phishing service has taken action against it. The current operational status is offline; the site has been taken down, but the underlying infrastructure – the Cloudflare DNS configuration and the Google-owned IP – remains in place and could be reused for future campaigns. The evidence does not reveal the exact payload or credential‑harvesting mechanism, and no additional payload hashes, C2 endpoints, or phishing page screenshots have been released.

Defenders should continue to block the domain at DNS and network layers, monitor the associated IP address for any resurgence of activity, and add the domain to internal indicator‑of‑compromise (IOC) lists. Because the domain leverages a legitimate Google IP, extra caution is advised when inspecting traffic to that address, as legitimate Google services will also use the same prefix. Continuous re‑evaluation of the domain’s status is recommended, especially if it becomes reachable again or if additional security vendors report new detections.