klima[.]airsdropsalert[.]lol

klima.airsdropsalert.lol was registered through Dynadot LLC on 5 November 2025. The domain resolves to the IP address 172.253.63.104, which is owned by AS15169 Google LLC and geolocated in the United States. The authoritative name servers listed are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. The site presented a page title of “Google”, matching the declared brand target of Google, and therefore qualifies as a brand‑impersonation attempt. No TLS certificate was observed, meaning the service was delivered over plain HTTP.

VirusTotal collected scans from 95 vendors, with seven returning a positive detection, and the domain appears on one external security blocklist. The site was taken offline and subsequently blocked by the PhishDestroy mitigation service. The current HTTP status is unavailable because the host is offline. Analysis confirms that the infrastructure leverages legitimate Google IP space, a common tactic to increase credibility and evade network‑based filters. The use of Cloudflare name servers further obscures the true hosting environment, complicating attribution.

While the domain’s page content has not been captured, the combination of a Google‑related title, the brand‑target label, and the observed detections strongly indicate a malicious impersonation campaign aimed at harvesting credentials or delivering additional payloads. Uncertainties remain regarding the exact payload delivered, the phishing kit employed, and the duration of active exploitation prior to takedown. Defenders should continue to block the domain at the DNS layer, monitor for any resurgence of the same host name or similar sub‑domains, and update endpoint and web‑gateway filters with the observed indicators of compromise, including the IP address 172.253.63.104, the Cloudflare name servers, and the VirusTotal detection count.