klima[.]airsdropsalerts[.]lol

Analysis of the domain klima.airsdropsalerts.lol shows a clear pattern of brand impersonation targeting Google. The domain was registered on November 07, 2025 through Dynadot LLC and is hosted on the IP address 142.250.185.132, which belongs to AS15169 Google LLC and is located in the United States. Although the IP is owned by Google, the domain itself is unrelated to the corporation and does not present a valid SSL certificate, leaving the connection unencrypted. The page title returned by the server is "Google," matching the declared brand target.

The domain resolves via Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common infrastructure choice for malicious actors seeking DDoS resilience and anonymity. VirusTotal scanning flagged the domain in 13 of 95 security vendors, and it appears on at least one external blocklist, indicating that multiple independent sources have identified it as malicious. PhishDestroy has taken the site offline, and current status confirms the domain is no longer serving content. The elevated risk rating reflects the combination of brand spoofing, lack of transport security, and vendor detections.

Uncertainty remains around the specific content that was delivered before takedown, as no snapshot of the landing page is available. Defenders should block the domain at network perimeter, add its IP address to deny lists, monitor for any future DNS resolutions pointing to the same IP or Cloudflare name servers, and update detection rules to flag any HTTP responses that include the page title "Google" originating from this host. Continuous intelligence sharing with threat‑intel platforms is recommended to capture any re‑use of the infrastructure.