degen[.]airdrpsalerts[.]cfd

Analysis of the domain degen.airdrpsalerts.cfd indicates a brand‑impersonation infrastructure targeting Google. The domain was registered through Dynadot LLC on 29 October 2025 and resolves to the IP address 142.250.185.196, which belongs to AS15169 (Google LLC) located in the United States. Despite the IP being owned by Google, the domain does not present an SSL certificate and its page title is simply “Google”. The lack of encryption combined with the generic title suggests an attempt to lure victims by presenting a familiar brand name without offering a secure connection. The domain appears on a single security blocklist and has been flagged by PhishDestroy.

VirusTotal reports two detections out of ninety‑five scanned engines, confirming that at least two security products regard the host as malicious. Gridinsoft assigns a trust score of 0 / 100, reinforcing the low reputation assessment. Nameservers are listed as brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. Current infrastructure status is offline, implying the site has been taken down or is no longer reachable.

What remains uncertain is the exact payload or phishing kit delivered, as no HTTP response details or content analysis have been publicly released. Defenders should continue to block the domain at perimeter filters, monitor the associated IP for any future reuse, and consider adding the domain to local deny lists. Given the association with Google’s IP space, organizations may also want to validate any unexpected Google‑related traffic originating from this address. Ongoing observation of the registrar Dynadot and the Cloudflare nameservers could provide early warning of re‑registration or related campaigns.