spaceandtime[.]airdrpsalert[.]sbs

Analysis of spaceandtime.airdrpsalert.sbs indicates that the domain was registered on October 22, 2025 through Dynadot LLC and is hosted on the IP address 172.253.62.103, which belongs to AS15169 Google LLC in the United States. The domain resolves to the same IP used by legitimate Google services, but the lack of an SSL certificate and the page title “Google” suggest intentional brand impersonation. The infrastructure is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common pattern for proxy‑based phishing setups.

The site has been listed on a single public blocklist, PhishDestroy, and the Gridinsoft trust score is 0 out of 100, indicating a high confidence of malicious intent. VirusTotal scans show that three of ninety‑five security vendors flagged the domain, reinforcing the suspicion. The site’s current HTTP status is offline, which may be a temporary takedown or a switch to a new command‑and‑control location.

No SSL/TLS certificate is presented, which prevents encrypted communication and further evidences the fraudulent nature of the host. Defenders should update firewall and DNS filtering rules to block both the domain and its resolving IP, monitor for any reappearance of the domain under the same registrar or nameserver configuration, and consider adding the IP to threat‑intel feeds. Continuous observation of Cloudflare‑based name servers and the Dynadot registration window is advised, as adversaries often recycle similar domains for subsequent campaigns targeting Google users.