bnc[.]airsdropsalerts[.]cfd

Analysis of bnc.airsdropsalerts.cfd indicates a confirmed brand impersonation campaign targeting Google, operational since its registration on November 7, 2025. The domain resolved to 142.250.65.228, an IP address assigned to Google LLC (AS15169) in the US, though this appears to be a misdirection or misconfiguration, as the domain was hosted behind Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com). No SSL certificate was present, increasing the likelihood of unencrypted credential harvesting. The page title 'Google' directly aligns with the identified scam type of brand impersonation, though the exact content and functionality of the site remain unconfirmed due to its current offline status.

Detection coverage is limited but notable: 11 of 95 security vendors on VirusTotal flagged the domain, and it appears on one security blocklist (PhishDestroy). Trust scores from Gridinsoft and Scamadviser are at the lowest possible rating (0/100 and 1/100, respectively), reinforcing its malicious classification. The domain was registered through Dynadot LLC, a registrar frequently abused for phishing infrastructure.

Defenders should treat this domain as high-risk for Google credential theft or malware distribution, particularly given its offline status, which may indicate temporary takedown or evasion. Blocking the domain at DNS and proxy levels is recommended, along with monitoring for related infrastructure using the same nameservers or registrar. Further investigation into the IP resolution anomaly and any associated malware samples is advised, though no active payloads or redirect chains are currently observable.