abstract[.]airdrpsalert[.]cfd

Analysis of abstract.airdrpsalert.cfd indicates a brand impersonation phishing domain targeting Google, operational as of October 22, 2025, and taken offline by July 23, 2026. The domain was registered through Dynadot LLC and used Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com). At the time of assessment, it resolved to IP 142.250.80.100, geolocated to the United States under AS15169 (Google LLC), though this resolution may reflect sinkholing or residual DNS caching rather than active hosting. No SSL certificate was detected, increasing susceptibility to interception or detection by network security tools. The page title was recorded as 'Google,' aligning with the reported scam type of brand impersonation.

Detection coverage was limited but notable: 13 of 95 security vendors on VirusTotal flagged the domain, and it appeared on one security blocklist. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as malicious. PhishDestroy blocked the domain, though the specific detection mechanism or timing is not detailed. Defenders should treat this domain as confirmed malicious infrastructure.

Historical DNS records and passive DNS data may reveal additional resolutions or related campaigns. Network security teams are advised to block the domain and IP at perimeter controls, and to monitor for internal connections to 142.250.80.100 that may indicate residual compromise or misconfiguration. The absence of SSL and the use of Cloudflare nameservers are consistent with low-effort phishing operations, though the exact content or payload delivered remains unanalysed. Further investigation into the registrar timeline or hosting provider actions may clarify takedown timelines or related domains.