eth[.]airdrpsalerts[.]cfd

This domain, eth.airdrpsalerts.cfd, was registered on 29 October 2025 through Dynadot LLC and is currently listed as offline. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. DNS resolution points to IP address 142.250.185.132, which belongs to AS15169 (Google LLC) and is geolocated in the United States. No TLS certificate is presented for the host, confirming the absence of HTTPS support.

The sole HTML element observed in the limited capture is a page title of “Google”, matching the declared brand target of Google and the classified scam type of brand impersonation. Low reputation scores have been recorded: Scamadviser rates the site 1 / 100 and Gridinsoft 0 / 100, reflecting extreme distrust. The domain appears on two public blocklists—PhishDestroy and ScamSniffer—both of which flag it for malicious activity. VirusTotal analyses show that four of ninety‑five security vendors flagged the domain, providing additional corroboration of its malicious intent.

No further details about payload, credential‑harvesting forms, or redirection behavior are available because the site is not presently serving content. Given the combination of a brand‑targeted page title, low trust metrics, blocklist inclusion, and multi‑vendor detection, defenders should treat eth.airdrpsalerts.cfd as a confirmed Google brand‑impersonation infrastructure. Recommended mitigations include adding the domain to network‑level deny lists, updating web‑filter policies to block HTTP requests to the host, and monitoring DNS queries for the associated IP address and Cloudflare nameservers. Continuous re‑evaluation is advised in case the site becomes active again, at which point a full content scrape should be performed to capture any credential‑stealing pages.