scr[.]airdrpsalert[.]life

The domain scr.airdrpsalert.life is currently offline but was observed resolving to the IP address 172.217.23.100, which belongs to Google LLC (AS15169) and is geolocated in Italy. Registration was performed via Cloudflare, Inc., and no SSL certificate was presented when the site was reachable, indicating an unsecured HTTP endpoint. The page title returned by the server was "Google," matching the declared brand target and confirming the intent to impersonate the Google brand. Security telemetry shows a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. Two of ninety‑five VirusTotal scanners flagged the domain, providing limited but corroborating evidence of malicious intent. The domain is listed as blocked by PhishDestroy and has been classified under the scam type "Brand Impersonation."

Infrastructure analysis reveals that the domain leveraged Cloudflare's DNS and hosting services, a common tactic to obscure the true origin of phishing infrastructure. The absence of nameserver information (NS_NOT_FOUND) hinders precise attribution of the underlying hosting configuration. No TLS certificate was observed, which may have been a deliberate choice to avoid certificate‑pinning defenses that could expose the impersonation attempt.

Defenders should continue to block the resolved IP address 172.217.23.100 for traffic associated with this domain, despite its legitimate ownership, as the IP is being abused for malicious purposes. Adding scr.airdrpsalert.life to internal URL blocklists and configuring web filtering solutions to flag any HTTP requests to the domain will prevent accidental exposure. Monitoring Cloudflare‑registered domains that resolve to Google‑owned IP space can help identify future impersonation campaigns that reuse similar infrastructure. Because the site is offline, ongoing reconnaissance should focus on any re‑registration attempts or related subdomains that may appear in threat feeds.