aethir[.]airdrpsalerts[.]xyz

This domain, aethir.airdrpsalerts.xyz, was created on 04 November 2025 and is presently taken offline. It is classified as a brand‑impersonation campaign targeting Google, as indicated by the page title “Google” and the declared scam type. The site resolves to 216.58.206.68, an IP address owned by AS15169 Google LLC located in Germany, suggesting the use of a legitimate Google‑owned host to blend with normal traffic. No TLS certificate is presented, meaning the site would be served over HTTP only. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑operated, which is consistent with many fast‑flux or abuse‑resilient setups.

Detection intelligence shows that 15 of 95 VirusTotal scanners flagged the domain, and it appears on a single external blocklist. The phishing‑specific blocklist PhishDestroy has already blocked the domain. Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 0/100. The registrar is Dynadot LLC, a common registrar for malicious registrations. Uncertainty remains regarding the current content of the site, as it is offline and no SSL/TLS handshake was observed.

The exact phishing kit or payload has not been captured, and no Safe Browsing or OTX entries are referenced in the available data. Defenders should immediately add aethir.airdrpsalerts.xyz to DNS and proxy blocklists, monitor the associated IP 216.58.206.68 for any sudden traffic spikes originating from this host, and consider reviewing Cloudflare name‑server patterns for related domains. Continued observation of the registrar Dynadot for new registrations resembling this pattern is advised. Because the domain leverages a legitimate Google IP, network‑level controls such as IP reputation filtering should be applied cautiously to avoid collateral impact on genuine Google services.