zircuit[.]airdrpalerts[.]sbs

Analysis of zircuit.airdrpalerts.sbs shows a domain created on October 25, 2025 and currently taken offline. The domain resolves to IP address 142.251.40.228, which belongs to AS15169 Google LLC and is geolocated in the United States. Registration was performed through Dynadot LLC. DNS resolution uses the Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No SSL certificate is presented for the host, indicating that HTTPS is not configured.

The HTTP response returns a page whose title is exactly "Google", matching the declared brand target of Google and confirming the brand‑impersonation purpose. VirusTotal scans recorded five positive detections out of ninety‑five security vendors, confirming that multiple AV engines flag the domain as malicious. The domain appears on one public security blocklist and has been blocked by the PhishDestroy mitigation service. Although the site is offline, the combination of a Google‑related page title, the absence of TLS, the presence of multiple vendor detections, and inclusion on a blocklist constitute strong evidence of a brand‑impersonation campaign.

Uncertainty remains regarding the specific phishing kit or payload because no further payload analysis or content capture is available. Defenders should continue to block the domain at DNS and proxy layers, monitor the hosting IP for any re‑use, and add the domain to internal blocklists. Additional scrutiny of traffic to the associated IP range is advised, as the IP is owned by Google and may host legitimate services. Continuous re‑evaluation is recommended in case the domain is re‑activated or similar domains are registered using the same registrar or name‑server pattern.