tia[.]airdrpsalert[.]sbs

The domain tia.airdrpsalert.sbs was observed as an active brand‑impersonation site targeting Google. Registration data show the domain was created on 22 October 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to 142.250.185.132, an address owned by AS15169 Google LLC located in the United States, and the domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was presented, meaning any traffic would have been served over unencrypted HTTP.

The page title returned by the server is “Google”, matching the declared brand target and the scam classification of brand impersonation. Security‑vendor scans on VirusTotal recorded three positive detections out of ninety‑five scanners, and Gridinsoft assigned a trust score of zero out of one hundred, indicating a high confidence of malicious intent. The site has been added to the PhishDestroy blocklist and appears on one additional public blocklist.

The combination of a Google‑owned IP, lack of SSL, and the use of reputable Cloudflare DNS suggests the domain may have leveraged legitimate infrastructure to host malicious content, a technique that can evade simple IP‑based filtering. Defenders should continue to block the domain at DNS and proxy layers, monitor the IP address for any resurgence of malicious activity, and consider adding the host to reputation‑based deny lists. Ongoing surveillance of the registrar Dynadot and the associated Cloudflare name servers is recommended to detect future sub‑domains that might be used for similar impersonation campaigns.