recall[.]airsdropsalert[.]lol

Analysis of recall.airsdropsalert.lol shows a domain registered on November 5 2025 through Dynadot LLC. The domain resolves to the IP address 142.250.185.228, which is announced by AS15169 and owned by Google LLC in the United States. The hosting infrastructure therefore shares the same address space as legitimate Google services, a technique often used to lend credibility to impersonation campaigns. The site presents the page title “Google” and is explicitly listed as impersonating the Google brand. No TLS certificate was observed; the HTTP service operated without encryption, which is atypical for genuine Google domains. The domain is presently taken offline, and the current status is reported as “offline”.

It has been blocked by the PhishDestroy filtering service and appears on one external security blocklist. Gridinsoft assigned a trust score of 0 out of 100, indicating a malicious classification. VirusTotal scans returned 7 positive detections out of 95 vendor submissions, confirming that multiple security engines flag the domain as malicious. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑managed, a common choice for fast‑flux or disposable phishing sites.

The elevated risk level reflects the combination of brand impersonation, malicious detections, and the use of a reputable IP range. Uncertainty remains regarding the exact content that was served before takedown, as no SSL certificate or page capture is available. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the listed nameservers, and add the IP address to reputation‑based deny lists. Additional verification of any residual traffic to the IP should be performed, and incidents involving credential submission to Google‑related services should be investigated for possible compromise.