flow[.]airdrpalerts[.]sbs

The domain flow.airdrpalerts.sbs was registered on October 25, 2025 through Dynadot LLC and is currently listed as taken offline. DNS resolution points to the IP address 142.251.179.104, which belongs to AS15169 Google LLC and resides in the United States. The page title returned by the server is "Google", matching the declared brand target and confirming the domain’s intent to impersonate Google. No SSL certificate is presented, meaning the site operates without HTTPS protection.

The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. On VirusTotal the host was flagged by five of ninety‑five scanning engines, indicating modest but notable detection by threat‑intel vendors. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the assessment that the infrastructure is untrusted. Nameserver records show brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services.

The available evidence establishes a clear brand‑impersonation campaign that leverages a legitimate Google‑owned IP range to lend credibility, yet the lack of TLS and the low trust score suggest a low‑sophistication deployment that was quickly taken offline. Uncertainty remains regarding any active payloads, credential‑harvesting mechanisms, or additional hosting infrastructure because the site is no longer reachable and no page content beyond the title has been captured. Defenders should continue to monitor for re‑registration of the domain or similar sub‑domains, enforce strict URL filtering for the airdrpalerts.sbs suffix, and ensure that any inbound connections to the associated IP are logged and inspected. Adding the domain to internal blocklists, confirming that existing web‑gateway and endpoint protection solutions flag the host, and reviewing Cloudflare DNS activity for anomalous queries are recommended mitigation steps.