ip[.]airdrpsalert[.]life

On July 22, 2026 analysts observed the domain ip.airdrpsalert.life listed as offline but previously associated with a brand‑impersonation campaign targeting Google. Historical DNS data shows the domain resolved to the IP address 142.250.184.228, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain was registered through Cloudflare, Inc., yet no SSL certificate was provisioned for the site, indicating that any HTTPS service would have been unavailable or misconfigured. The only visible HTTP attribute was a page title of "Google," matching the declared brand target.

Nameserver information was not returned, limiting insight into the authoritative DNS infrastructure. Security‑vendor signals indicate that the domain appeared on a single blocklist and was actively blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme malicious confidence. VirusTotal reported that two of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of malicious intent.

The domain’s classification as a brand‑impersonation scam is consistent with the observed indicators, although the exact phishing kit or payload was not captured. Because the site is currently offline, immediate traffic cannot be inspected, but defenders should continue to block the domain and the associated IP address in perimeter defenses. Monitoring for any re‑registration or similar domains using the same Cloudflare registrar, as well as periodic re‑scans of the IP range, is advised to mitigate potential re‑use of the infrastructure. Organizations should also educate users about unexpected Google‑related URLs and enforce strict URL verification policies to reduce exposure to future impersonation attempts.