spaceandtime[.]airdrpalert[.]click

Analysis of the domain spaceandtime.airdrpalert.click, first observed on October 30, 2025, indicates that it was used for a Google brand impersonation campaign. The domain resolves to IP address 142.250.191.4, which is owned by AS15169 Google LLC and geolocated in the United States. Despite the IP belonging to Google’s infrastructure, the domain was registered through Dynadot LLC and is hosted on Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com). No SSL certificate was presented for the site, and the HTTP service is currently offline, confirming that the phishing infrastructure has been taken down.

The page title returned when the site was reachable was "Google," matching the declared brand target. Threat intelligence feeds show that 16 of 95 VirusTotal scanners flagged the domain as malicious, and the domain appears on at least one external security blocklist, where it was also blocked by the PhishDestroy service. The Gridinsoft trust score of 0 out of 100 further reflects the high confidence in its malicious nature.

While the exact phishing kit or payload was not captured, the convergence of a Google‑focused page title, the brand impersonation classification, and multiple vendor detections provides sufficient evidence to classify the infrastructure as a brand‑impersonation threat with an elevated risk rating. Defenders should ensure that the domain is added to internal blocklists, monitor DNS queries for the domain and its associated IP address, and continue to track any re‑registration attempts. Given the current offline status, ongoing vigilance is advised in case the operators re‑deploy the campaign using new subdomains or alternative hosting arrangements.