usual[.]airdrpalert[.]click

Analysis of the domain usual.airdrpalert.click indicates a brand‑impersonation campaign targeting Google. The domain was registered through Dynadot LLC on 30 October 2025 and resolves to IP 172.253.62.99, which is allocated to AS15169 Google LLC in the United States. Hosting the malicious payload on an IP owned by the legitimate brand is a technique used to increase credibility and evade network‑based reputation checks. The site presents a page title of "Google" but no SSL certificate is deployed, leaving the connection unencrypted.

Nameserver records point to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming Cloudflare DNS services. Gridinsoft assigns a trust score of 0 out of 100, reflecting a highly suspicious reputation. VirusTotal analysis shows that three of ninety‑five security vendors flagged the domain, providing modest but corroborating detection evidence. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, indicating that at least one defensive organization has taken mitigation steps.

Current status is offline, so live content cannot be examined, and no additional behavioral indicators such as HTTP response codes or payload samples are available. Defenders should continue to block the domain at the DNS layer, add it to internal URL filtering lists, and monitor for any future re‑activation or look‑alike registrations. Given the use of a Google‑owned IP address and the absence of TLS, the domain presents an elevated risk of credential‑stealing or malware delivery despite limited detection coverage. Ongoing surveillance of related Cloudflare nameservers and the registrar Dynadot for new registrations that mimic this pattern is recommended.