cetus[.]airdrpalert[.]click

cetus.airdrpalert.click was registered through Dynadot LLC on 30 Oct 2025. The domain resolves to 142.250.184.196, an address owned by AS15169 Google LLC located in the United States. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com indicate Cloudflare DNS services. No HTTPS certificate was observed, meaning the site operated without TLS.

The page title returned “Google”, and the listed brand target is Google, classifying the site as a brand‑impersonation campaign. VirusTotal records show that nine of ninety‑five scanning engines flagged the domain as malicious. Gridinsoft assigned a trust score of 0 / 100, and the domain appears on at least one public security blocklist. PhishDestroy has also listed the domain as blocked.

The site’s current HTTP status is offline, suggesting that the phishing infrastructure has been taken down or is otherwise unavailable. Evidence points to a short‑lived infrastructure that leveraged a legitimate Google IP range to lend credibility to the impersonation attempt. Defenders should continue to block the domain at perimeter firewalls and DNS resolvers, monitor for any resurgence of the same hostnames or similar Cloudflare‑based configurations, and consider adding the domain to internal threat intelligence feeds. Ongoing observation of the registrar Dynadot and the associated Cloudflare nameservers may help identify future campaigns that reuse this pattern.