cetus[.]airdrpsalert[.]cfd

The domain cetus.airdrpsalert.cfd was observed as a brand‑impersonation attempt targeting Google. The domain is registered through Dynadot LLC and was created on 22 October 2025. DNS resolution points to IP address 142.250.185.100, which resolves to the Google LLC autonomous system AS15169 located in the United States. The hosting IP belongs to the legitimate Google infrastructure, which may be leveraged to lend credibility to the malicious site. No TLS certificate was presented when the domain was queried, indicating the site was served over plain HTTP. The page title returned by the HTTP response is “Google”, matching the declared brand target.

Cloudflare‑managed nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com are in use. Security‑vendor analysis on VirusTotal shows that 14 of 95 scanners flagged the domain as malicious. The domain appears on one public security blocklist and has been actively blocked by the PhishDestroy mitigation service. Gridinsoft assigned a trust score of 0 / 100, and the overall trust rating is therefore extremely low. The site’s current status is listed as offline, suggesting that the phishing infrastructure has been taken down or is no longer serving content.

The available evidence confirms a clear intent to impersonate Google, but the exact payload, credential‑collection mechanism, or landing‑page content has not been disclosed in the available intelligence. Consequently, defenders cannot determine whether the domain was used for credential harvesting, malware delivery, or other secondary objectives. Given the observed indicators, defensive teams should continue to block the domain at perimeter filters, update URL‑categorization services, and monitor related subdomains that may be registered under the same registrar or share the Cloudflare nameservers.