send[.]airdrpsalert[.]sbs

Analysis of the domain send.airdrpsalert.sbs indicates a brand impersonation campaign targeting Google, classified with an elevated risk level as of July 23, 2026. The domain was registered on October 22, 2025, through Dynadot LLC and currently resolves to the IP address 142.251.40.164, which is geolocated in the United States under AS15169 (Google LLC). Nameserver records point to Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common infrastructure choice for both legitimate and malicious domains. Security vendor detections on VirusTotal report that 11 out of 95 engines flag this domain as malicious. It appears on one security blocklist and is actively blocked by PhishDestroy.

The page title captured from the domain is 'Google,' aligning with the reported scam type of brand impersonation. No SSL certificate was observed at the time of analysis, and the domain has since been taken offline. Infrastructure analysis reveals that while the IP address is associated with Google LLC, this does not confirm legitimacy, as threat actors occasionally leverage reputable hosting providers. The absence of an SSL certificate further reduces the domain's credibility, as modern phishing sites typically employ encryption to evade detection. The combination of Cloudflare nameservers, a Google-associated IP, and a registration date nearly nine months prior to the report suggests an attempt to blend in with legitimate traffic while maintaining operational security.

Defenders should treat this domain as confirmed malicious based on vendor detections and blocklist inclusion. Network-level blocking of the domain and its resolved IP is recommended. Organizations using Google services should monitor for unauthorized access attempts linked to this domain, particularly if user credentials were exposed prior to its takedown.