metis[.]airdrpsalerts[.]info

Analysis indicates that the domain metis.airdrpsalerts.info resolves to the IP address 172.253.62.104, which is allocated to AS15169 Google LLC in the United States. The domain was registered through Cloudflare, Inc., but the nameserver information is unavailable, reported as NS_NOT_FOUND. No TLS certificate is presented, meaning the site is served over plain HTTP only. The page title returned by the HTTP response is “Google”, matching the declared brand target of Google and confirming a brand‑impersonation attempt.

The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, suggesting that at least one security provider has taken remedial action. VirusTotal scans show that 13 of 95 antivirus and URL‑reputation engines flagged the domain, providing additional detection confidence. Current status is offline, so active probing is not possible, but the historical indicators remain relevant for threat‑intel correlation.

Uncertainty remains regarding the exact content delivered, any credential‑capture mechanisms, and whether the domain leveraged a phishing kit, as no page capture or kit fingerprint is available. Defenders should add the domain to internal URL blocklists, enforce DNS filtering for the host, and monitor for other Cloudflare‑registered domains that resolve to Google‑owned IP space. Continuous monitoring of Safe Browsing and other reputation services is advised to capture any re‑activation, and incident response teams should treat any attempted connections to this host as malicious.