zircuit[.]airdrpsalert[.]cfd

The domain zircuit.airdrpsalert.cfd was registered through Dynadot LLC on 22 October 2025 and is configured to use the Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to the IPv4 address 142.250.185.100, which belongs to AS15169 Google LLC and is geolocated in the United States. The lack of an SSL/TLS certificate indicates that the site was served over plain HTTP. The page title returned by the host is the literal string “Google”, matching the declared brand target and confirming the intent to masquerade as the well‑known search‑engine brand. Static analysis shows a Gridinsoft trust score of zero out of one hundred, reflecting an extremely low confidence in legitimacy.

VirusTotal has logged 11 detections out of 95 scanned security vendors, and the domain appears on a single active blocklist, where it is listed by PhishDestroy as a brand‑impersonation site. No additional malware kits or payload indicators have been observed. Current operational status is offline, meaning the site is not presently reachable. However, the infrastructure – a Google‑owned IP address and Cloudflare name servers – suggests that the attacker may be leveraging legitimate hosting resources to increase credibility and evade simple network‑based blocking.

Defenders should add the domain to internal URL filtering rules, verify that outbound connections to 142.250.185.100 are monitored, and continue to reference the PhishDestroy blocklist entry. Because the site is hosted on a Google AS, any future resolution changes should be re‑examined for signs of re‑activation. Continuous scanning with multi‑vendor services such as VirusTotal is recommended to capture any new detections. Absence of SSL does not diminish the risk, as the primary malicious behavior is brand impersonation rather than credential harvesting over encrypted channels.