fil[.]airsdropsalerts[.]click

Analysis as of July 23 2026 shows that fil.airsdropsalerts.click is actively flagged by multiple threat‑intelligence sources. VirusTotal records indicate that 13 of 95 scanned security vendors have identified the domain as malicious, confirming a consensus of detection across independent scanners. The domain is registered through Dynadot LLC and uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the host. The site’s sole HTML title resolves to “Google”, matching the declared brand target and confirming the classification as a brand‑impersonation campaign against Google.

DNS resolution points to IP 142.250.74.196, which belongs to ASN 15169 and is owned by Google LLC, indicating that the malicious actor is leveraging legitimate Google infrastructure to host the payload. The domain was created on 7 November 2025, suggesting a relatively recent registration. No TLS certificate is presented, and HTTPS connections are unavailable. The domain currently appears on a single public blocklist and has been explicitly blocked by PhishDestroy.

At the time of assessment the host is taken offline, limiting immediate exposure but leaving the underlying infrastructure intact. Defenders should continue to block the domain at perimeter firewalls and proxy filters, add the IP address to threat‑feed watchlists, and monitor for any re‑activation attempts. Given the low trust score, the presence on multiple vendor detections, and the use of a trusted Google IP, the domain should be treated as high‑confidence brand‑impersonation and included in security‑aware browsing policies. Ongoing observation of the registrar and nameserver changes is advised to detect potential re‑deployment.