euler[.]airdrpsalert[.]cfd

This investigation concerns the domain euler.airdrpsalert.cfd, observed as a Google brand impersonation campaign. The domain was registered on 22 October 2025 through Dynadot LLC and utilizes Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP address 142.250.186.164, an address owned by Google LLC (AS15169) located in the United States. No TLS certificate was presented when the host was queried, indicating that the site operated without HTTPS. The page title returned by the server was simply "Google," matching the declared brand target.

Malware and phishing detection services on VirusTotal flagged the domain in 10 of 95 vendor checks, and the domain appears on a single external blocklist. The threat was also listed as blocked by the PhishDestroy service. Independent trust scoring from Gridinsoft assigned a score of 0 out of 100, reflecting a high confidence in malicious intent. The campaign was classified with a risk level of elevated, and the current operational status is offline. Evidence confirms that the infrastructure leverages legitimate Google‑owned IP space, a common tactic to increase credibility and evade network‑based reputation filters.

The absence of an SSL certificate, combined with a low trust score and multiple vendor detections, further substantiates the malicious nature of the domain. However, because the site is currently taken offline, no direct payload or phishing page content could be examined, and the exact tactics used to harvest credentials remain unknown. Defenders should immediately add euler.airdrpsalert.cfd to network and endpoint blocklists, enforce DNS filtering, and monitor for any re‑registration or re‑use of the same domain or similar sub‑domains. Continuous observation of traffic directed to the associated IP address is recommended, as legitimate Google services share the same address space and false positives may arise.