aethir[.]airdrpsalert[.]bond

This domain, aethir.airdrpsalert.bond, is flagged as a brand impersonation threat targeting Google, with an elevated risk classification. Analysis indicates the domain was registered on October 26, 2025, through Dynadot LLC and is currently offline. Infrastructure analysis reveals it resolves to the IP address 142.250.186.68, which is geolocated in Germany under AS15169 (Google LLC). The use of Google’s IP space may suggest an attempt to appear legitimate or exploit perceived associations with the brand.

Nameservers are hosted on Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure hosting origins and enhance resilience. The domain appears on one security blocklist (PhishDestroy) and is flagged by 2 of 95 security vendors on VirusTotal, reinforcing its malicious classification. No SSL certificate is present, which is atypical for legitimate services and further indicates potential fraudulent intent. The page title, 'Google,' aligns with the reported brand impersonation scam type.

Defenders should treat this domain as confirmed malicious infrastructure. Recommended actions include blocking the domain and IP at perimeter security controls, monitoring for related subdomains or newly registered lookalike domains, and reviewing logs for connections to 142.250.186.68 or the Cloudflare nameservers. Given the domain’s current offline status, defenders should prioritize retrospective analysis to identify any prior compromise indicators linked to this infrastructure.