airdrpsalert[.]sbs

Analysis of airdrpsalert.sbs indicates a brand‑impersonation campaign targeting Google. The domain was registered on 22 Oct 2025 through Dynadot LLC and its DNS is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. HTTP requests resolve to IP 142.250.185.100, which belongs to AS15169 Google LLC in the United States, suggesting the attacker is leveraging legitimate Google infrastructure to increase credibility. No TLS certificate is presented, meaning the site is served over plain HTTP.

The page title returned by the server is “Google”, matching the declared brand target. VirusTotal has recorded nine detections out of ninety‑five scanners, confirming that multiple security products flag the domain as malicious. The domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—and receives a Gridinsoft trust score of 0 / 100, reinforcing the malicious classification. The site is currently offline, so live content cannot be inspected, and no additional indicators such as payload hashes or phishing page screenshots are available.

Defenders should block resolution of airdrpsalert.sbs at the network perimeter and add the associated IP address to host‑based deny lists, recognizing that the IP is owned by Google and may be shared with legitimate services. Monitoring of DNS queries for the Cloudflare nameservers used by this domain can help detect future re‑use of similar infrastructure. Because the domain is hosted on a legitimate cloud provider, threat‑intel feeds should be consulted for any resurgence of the same domain or similar variations. Continuous re‑scanning with multi‑engine services is advised to capture any changes if the site becomes active again.