plume[.]airsdropsalerts[.]cfd

Analysis of plume.airsdropsalerts.cfd indicates that the domain was registered through Dynadot LLC on 7 November 2025 and is currently taken offline. The authoritative name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com resolve the domain to the IP address 142.250.81.228, which belongs to AS15169 Google LLC located in the United States. Despite the IP belonging to Google’s infrastructure, the domain lacks an SSL/TLS certificate, exposing any HTTP traffic to interception. The page title returned from the server is “Google”, matching the declared brand target of Google and confirming the intent to impersonate that brand. VirusTotal records show that seven of ninety‑five scanning engines flagged the domain as malicious, and the domain appears on a single external blocklist.

PhishDestroy has also listed the domain as blocked. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The overall scam classification is “Brand Impersonation”, consistent with the observed page title and target brand. Evidence confirms the domain’s malicious purpose, but the limited number of vendor detections and the presence of only one blocklist entry suggest that broader detection coverage may be incomplete.

The offline status prevents active probing, leaving the exact content of the site unverified. Defenders should continue to monitor DNS queries for the domain and enforce deny‑list rules for the resolved IP address, especially in environments that trust Google’s network ranges. Adding the domain to internal threat intelligence feeds and ensuring that web filtering solutions block both HTTP and HTTPS requests to the host will reduce the risk of inadvertent exposure. Additional scans with a wider set of sandbox and reputation services are recommended to capture any evolving indicators that may not yet be reflected in existing vendor feeds.