scr[.]airdrpsalert[.]click

This domain, scr.airdrpsalert.click, was observed targeting the Google brand through a page titled “Google”. The domain was registered on October 26, 2025 via Dynadot LLC and is currently taken offline. DNS resolution points to the IPv6 address 2607:f8b0:4004:c21::6a, which belongs to AS15169 Google LLC located in the United States. The domain is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS while the hosting IP is owned by Google. No SSL certificate was presented, meaning the site operated without HTTPS.

VirusTotal records show that 11 of 95 scanned security vendors flagged the domain as malicious. The site appears on a single external blocklist and has been blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The scam type is classified as brand impersonation, specifically impersonating Google. Evidence from the page title and the vendor detections confirm the intent to deceive users into believing they are interacting with a legitimate Google service.

Because the site is offline, active content cannot be examined, and the exact phishing payload or credential‑harvesting mechanism remains unknown. The lack of HTTPS, combined with the use of a legitimate Google‑owned IP address, suggests an attempt to gain credibility through IP reputation. Defenders should add scr.airdrpsalert.click to URL and domain block lists, monitor DNS queries for the associated Cloudflare name servers, and enforce email filtering rules that detect unsolicited messages referencing Google login pages. Continuous observation of new domains registered through Dynadot and hosted on the same IP range is advisable, as threat actors may recycle similar infrastructure. Organizations should also verify that internal users are educated about the absence of TLS on suspicious login pages and encourage reporting of unexpected Google‑related URLs.