send[.]airdrpsalert[.]click

send.airdrpsalert.click was observed as a brand‑impersonation site targeting Google. The domain was registered on 26 October 2025 through Dynadot LLC and is currently taken offline. Infrastructure analysis shows the domain resolves to 142.250.185.100, an address owned by AS15169 Google LLC located in the United States. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. No TLS certificate is presented, so the site would have been served over plain HTTP if reachable.

The page title returned by the host is “Google”, matching the declared brand target. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one public blocklist. PhishDestroy has already blocked the domain. VirusTotal reports three detections out of ninety‑five scanning engines, confirming that at least a subset of security vendors consider the domain malicious. The limited detection count and single blocklist entry suggest the site had a short operational window before being taken down.

Evidence gaps include the lack of a captured HTTP response, absence of SSL/TLS details, and no publicly available screenshots or content analysis. Consequently, the exact phishing kit or credential‑harvesting method cannot be confirmed. Defenders should continue to block the domain at network perimeters, update URL filtering and DNS blocklists with the identified IP address and name‑server pair, and monitor for any re‑registration attempts. Because the domain points to a Google‑owned IP, any future use of the same address should be scrutinized for potential abuse. Ongoing vigilance on Cloudflare‑based name servers is advised, as they are frequently leveraged for quick‑deployment malicious sites.