magma[.]airdrpsalert[.]sbs

The domain magma.airdrpsalert.sbs was registered on October 22, 2025 through Dynadot LLC and currently resolves to the IP address 142.250.185.164, which is owned by AS15169 Google LLC and located in the United States. The domain’s authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No SSL certificate is presented for the site, and HTTP requests return no secure transport. The page title returned from the host is "Google", aligning with the declared brand target of Google.

The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal analysis shows five of ninety‑five security vendors flag the domain, providing limited but notable detection evidence. The domain is presently taken offline, which limits immediate observation of its content or behavior.

While the presence of a Google‑owned IP may be a tactic to increase perceived legitimacy, the lack of TLS and the blocklist entry suggest a low‑quality impersonation attempt. Defenders should continue to monitor the domain for any re‑activation, enforce blocklist rules in perimeter defenses, and consider adding the host to internal URL filtering policies. Additional investigation of HTTP response headers, potential redirection chains, and any associated payloads is recommended should the site become active again.