metis[.]airdrpsalerts[.]click

The domain metis.airdrpsalerts.click was registered through Dynadot LLC on 04 Nov 2025. It resolves to the IP address 142.251.40.132, which belongs to ASN 15169 owned by Google LLC and is geolocated in the United States. The site presents a page title of “Google”, matching the declared brand‑impersonation intent. No TLS certificate was observed, indicating that the site operated over plain HTTP.

Infrastructure analysis shows the domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common choice for fast‑flux and abuse campaigns. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal scans recorded fifteen detections out of ninety‑five submitted security vendors, providing independent confirmation of malicious behavior. Current connectivity checks report the domain as offline, which may be a temporary takedown or a deliberate shutdown after detection.

The available evidence does not reveal the specific payload or phishing kit used, nor does it indicate whether any credential‑harvesting pages were ever served. Defenders should continue to monitor the IP address 142.251.40.132 for any residual activity, enforce outbound filtering for the domain name, and update internal blocklists to include the full hostname. Because the domain leverages a legitimate Google‑owned IP range, network‑level reputation checks alone may be insufficient; correlation with DNS query logs and Cloudflare name‑server activity is recommended. Organizations that protect Google‑related credentials should treat any traffic to this hostname as suspicious and consider immediate quarantine of associated endpoints.