tia[.]airdrpsalerts[.]cfd

The domain tia.airdrpsalerts.cfd was registered on October 29, 2025 through Dynadot LLC and is currently marked as offline. Technical resolution shows the name resolves to the IP address 142.250.186.68, which belongs to AS15169 owned by Google LLC and is geolocated in Germany. The domain is hosted on Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but it does not present an SSL certificate, indicating that any web service would be delivered over plain HTTP if it were active. The page title returned from the site, when it was reachable, is simply "Google", matching the declared brand target of Google and confirming the classification as a brand‑impersonation attempt.

Threat intelligence feeds have placed the domain on one security blocklist, specifically PhishDestroy, and VirusTotal analysis shows that eight of ninety‑five scanning engines flagged the domain as malicious. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. While the IP address is owned by Google, the use of a legitimate Google‑owned address is a common tactic to lend credibility to phishing infrastructure. The lack of an SSL certificate, the presence on a phishing blocklist, and the low trust score collectively suggest the domain was intended for credential harvesting or other fraudulent activity targeting Google users.

Defenders should continue to block traffic to tia.airdrpsalerts.cfd at the network perimeter, monitor for any residual DNS queries, and consider adding the domain to internal deny lists. Because the site is offline, active exploitation is not currently observable, but the infrastructure indicates a prior capability to lure victims through brand impersonation. Ongoing vigilance is recommended, especially for users who may have previously interacted with the domain before its takedown.