euler[.]airdrpsalerts[.]click

Analysis of euler.airdrpsalerts.click indicates that the domain was actively used for a brand‑impersonation campaign targeting Google. The domain was registered through Dynadot LLC on 4 November 2025 and resolves to the IP address 172.253.62.105, which is assigned to AS15169 Google LLC in the United States. Although the IP belongs to Google’s network, the domain is not associated with any legitimate Google service; it presents no SSL certificate and therefore does not offer a secure HTTPS endpoint. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure for the malicious site.

The HTTP response that was observed returned a page title of “Google”, directly matching the declared brand target and reinforcing the impersonation intent. VirusTotal records show detections from 16 of 95 security vendors, and the domain is listed on at least one public blocklist, with PhishDestroy explicitly blocking it. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious behavior. The site is currently offline, but the historical evidence suggests it was employed to lure victims into a credential‑stealing flow.

Uncertainty remains regarding the exact payload or login form that was served before takedown, as no visual or content analysis is available. Defenders should maintain blocks on the domain at DNS and network layers, monitor for any re‑registration of the same hostnames or reuse of the IP address, and incorporate the observed indicators—such as the Cloudflare name servers, the IP 172.253.62.105, and the lack of TLS—into threat‑intel feeds. Reviewing outbound traffic logs for connections to this IP may reveal compromised accounts or additional malicious activity related to the impersonation campaign.