metis[.]airdrpalert[.]click

Analysis of metis.airdrpalert.click indicates that the domain was registered through Dynadot LLC on 30 Oct 2025. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑operated, which is consistent with rapid deployment of malicious infrastructure. DNS resolution returns a single IPv6 address 2607:f8b0:4004:c07::69 that belongs to AS15169, Google LLC, United States. The hosting IP is therefore owned by Google, a pattern often used to lend legitimacy to fraudulent sites.

No TLS certificate was observed; the site served HTTP only, and the page title returned by the server is “Google”, matching the declared brand target. The domain is currently offline, having been taken down and flagged by the PhishDestroy blocklist, where it appears on one security blocklist. VirusTotal scans show that 14 of 95 anti‑malware engines flagged the domain, confirming the presence of malicious indicators.

The limited visibility of the page content prevents confirmation of the exact phishing payload, but the combination of brand impersonation, use of a Google‑owned IP, and detection by multiple vendors aligns with known Google credential‑harvesting campaigns. Defenders should add the domain to local deny lists, monitor DNS queries for the IPv6 address, and enforce TLS inspection policies to capture any future HTTP traffic. Continuous re‑evaluation is advised in case the domain resurfaces under a new IP or obtains a valid certificate.