abstract[.]airdopalert[.]icu

Analysis of abstract.airdopalert.icu indicates that the domain was created on 20 October 2025 and is currently taken offline. Registration records show the domain was purchased through Dynadot LLC and delegated to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The domain resolves to IP address 192.178.155.103, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. No TLS certificate was observed, meaning the site served HTTP only. The page title returned by the server is “Google”, and the brand target listed is Google, consistent with a brand‑impersonation campaign.

VirusTotal scans have recorded 12 detections out of 95 security vendors, and Google Safe Browsing classifies the URL as a social‑engineering threat. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy mitigation service. The registration through Dynadopalert and delegation to Cloudflare nameservers provide a typical fast‑flux appearance, but the underlying IP belongs to Google’s own autonomous system, which reduces the likelihood of a third‑party hosting compromise. The absence of an SSL/TLS certificate suggests the operator relied on the trusted IP reputation rather than encryption to lure victims.

Because the site is no longer reachable, dynamic analysis of the content cannot be performed, leaving the exact credential‑harvesting technique unknown. Defensive recommendations include adding the domain and its IP address to deny‑list rules, enforcing strict outbound filtering for connections to the AS15169 prefix when originating from internal users, and monitoring for any resurgence of the domain or similar sub‑domains that resolve to the same IP. Continuous verification of Cloudflare name‑server entries for future registrations of the same brand‑impersonation pattern is also advised.