ip[.]airsdropsalerts[.]cfd

Analysis of the domain ip.airsdropsalerts.cfd indicates it was a brand-impersonation scam targeting Google, active until recently taken offline. The domain was registered on November 7, 2025, through Dynadot LLC and resolved to the IP address 142.250.186.68, which geolocates to Germany under AS15169 (Google LLC). While the IP itself is associated with legitimate Google infrastructure, the domain's use of this address appears to be an attempt to evade basic reputation checks rather than indicative of legitimate hosting. The domain's nameservers, brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggest Cloudflare was used as DNS provider, though no SSL certificate was present, increasing the risk of interception during transmission. The page title was explicitly 'Google,' aligning with the brand-impersonation classification.

Detection data from July 23, 2026, shows the domain was flagged by 6 of 95 security vendors on VirusTotal and appeared on at least one security blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, further supporting the malicious classification. No evidence of a phishing kit or specific payload was provided, so the exact mechanics of credential harvesting remain unconfirmed. The domain's current status is offline, though defenders should treat any future resolution or reactivation as high-risk.

Infrastructure analysis reveals a short-lived campaign with low detection coverage, suggesting either a targeted operation or early-stage deployment before wider detection. The use of a .cfd TLD, historically favored by threat actors for low-cost registration and minimal oversight, aligns with patterns observed in other phishing operations. Defenders are advised to block the domain at DNS and proxy levels, monitor for related subdomains or IP reuse, and alert users to the impersonation of Google services.