ip[.]airdrpsalert[.]cfd

The domain ip.airdrpsalert.cfd was created on October 22, 2025 and registered through Dynadot LLC. It is hosted on the IP address 142.251.16.104, which belongs to AS15169 Google LLC and is located in the United States. The domain uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and does not present an SSL certificate, serving content over plain HTTP. The page title returned by the site is "Google", matching the declared brand target of Google and confirming the classification as a brand‑impersonation campaign.

VirusTotal records show that three of ninety‑five security vendors flagged the domain, indicating limited but notable detection. The domain has been blocked by the PhishDestroy service and appears on one external security blocklist. Gridinsoft assigns a trust score of 0 out of 100, reinforcing its malicious reputation.

As of the report date, July 25, 2026, the site is offline, limiting immediate exposure, but the infrastructure details suggest the actors leveraged a legitimate Google‑owned IP range to increase credibility. Defenders should continue to block the domain and its resolved IP address, monitor for any re‑registration or similar naming patterns, and consider adding the domain to internal threat intelligence feeds. Additional safeguards include enforcing TLS for all outbound HTTP requests, scrutinizing DNS queries to Cloudflare resolvers for newly observed subdomains, and reviewing traffic to Google‑owned IP blocks for anomalous activity that may indicate abuse of trusted infrastructure.