fuel[.]airdrpsalerts[.]click

Analysis of the domain fuel.airdrpsalerts.click confirms it as a phishing site impersonating Google, with elevated risk indicators as of July 23, 2026. The domain was registered on November 4, 2025, through Dynadot LLC and is currently offline. Infrastructure analysis reveals it was hosted on Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and resolved to the IPv6 address 2607:f8b0:4004:c07::67, geolocated to the United States under AS15169 (Google LLC). Despite the IP association with Google, this does not indicate legitimate ownership, as threat actors frequently abuse cloud infrastructure for phishing operations. Detection data from security vendors indicates 14 of 95 engines on VirusTotal flagged the domain as malicious.

The domain appears on at least one security blocklist and is blocked by PhishDestroy. Trust scores from Gridinsoft (0/100) and Scamadviser (1/100) further corroborate its malicious classification. The page title was recorded as 'Google,' aligning with the reported brand impersonation scam type. No SSL certificate was detected, increasing the likelihood of interception or tampering during user interaction.

Defenders should treat this domain as confirmed malicious and prioritize blocking it at the DNS and network levels. The absence of an SSL certificate and the use of Cloudflare nameservers are consistent with phishing infrastructure, though the exact phishing kit or payload remains unconfirmed. Given the domain's current offline status, monitoring for reactivation or related domains registered through the same registrar or nameservers is recommended. Additional context, such as phishing email samples or redirect chains, is not available in the current dataset.