euler[.]airdrpsalerts[.]sbs

Analysis of the domain euler.airdrpsalerts.sbs indicates that it was actively used for a brand impersonation campaign targeting Google and has since been taken offline. The domain was registered on October 29, 2025 through Dynadot LLC, and its authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution maps the name to IP address 192.178.218.105, which is located in the United States and is announced by AS15169, the network operated by Google LLC. Despite the IP belonging to Google’s infrastructure, the domain lacked an SSL/TLS certificate at the time of observation, reducing the credibility of any purported secure connection. The page title returned by the host was simply "Google," matching the declared brand target.

Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence rating. VirusTotal scans recorded nine detections out of ninety‑five contributing security vendors, confirming that multiple scanners identified malicious characteristics. The domain appears on a single security blocklist and is specifically blocked by the PhishDestroy service. The threat is classified as brand impersonation, with the campaign explicitly impersonating Google.

Current evidence does not reveal the exact payload or phishing kit employed, nor does it provide details on the content served beyond the title. Defenders should continue to block the domain at network perimeter devices, update firewall and DNS filtering rules to include the observed IP address and name servers, and monitor for any resurgence of the domain or similar variations. Additional monitoring of the associated IP range is advisable given its affiliation with a major cloud provider, which may host other malicious actors leveraging the same infrastructure.