fil[.]airdrpsalert[.]locker

Analysis of the domain fil.airdrpsalert.locker confirms it was actively impersonating Google, as indicated by the page title 'Google' and explicit classification as brand impersonation. The domain was registered on October 26, 2025, through Dynadot LLC and resolved to the IP address 142.250.185.164, which is part of AS15169 (Google LLC). This infrastructure overlap with the legitimate brand adds complexity to attribution, though the domain itself lacked an SSL certificate, a common red flag in phishing operations.

Detection data shows the domain was flagged by 9 of 95 security vendors on VirusTotal and appeared on at least one security blocklist, including PhishDestroy. Gridinsoft assigned a trust score of 0/100, further supporting its malicious classification. The domain is now offline, but its nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) suggest prior use of Cloudflare services, a common tactic to obscure hosting origins.

While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, lack of SSL, and detection by multiple vendors provides strong evidence of malicious intent. Defenders should treat any prior resolution of this domain as a high-confidence indicator of compromise and monitor for related domains using similar naming patterns or infrastructure.