airdrpsalert.locker

The page title returned by the web server is “Google”, which does not correspond to the advertised brand target of Facebook and therefore provides no direct indication of the malicious content that may have been displayed. The domain is listed on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating consensus among community-driven mitigation platforms that the host is associated with brand-impersonation activity. VirusTotal recorded detections from seven of ninety-five scanned security vendors, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the classification as high-risk. AlienVault OTX references the domain in a single threat-intel pulse, further corroborating its presence in open-source intelligence.

Given the combination of a recent registration, use of a reputable hosting provider, absence of encryption, and multiple independent detections, defenders should treat any traffic to airdrpsalert.locker as malicious. Network sensors should block the IP 142.250.185.196 and the domain name, DNS resolvers should enforce deny-list policies for the four blocklists, and endpoint protection solutions should incorporate the VirusTotal detection signatures. Continuous monitoring of the associated IP range and Cloudflare nameservers is advised, as the infrastructure may be repurposed for future campaigns targeting Facebook users.