ip[.]airdrpsalert[.]click

The domain ip.airdrpsalert.click was registered on October 26, 2025 through Dynadot LLC and uses the Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP address 64.233.180.105, which is assigned to AS15169 Google LLC and geolocated in the United States. No SSL certificate is presented for the host, and the site is currently taken offline. The single observed page returns the title "Google," and the domain is explicitly classified as a brand‑impersonation campaign targeting Google.

Detection by external scanners shows that 2 of 95 security vendors on VirusTotal flagged the domain, and it appears on one security blocklist. PhishDestroy has already listed the domain as blocked, and Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of malicious intent. The limited public evidence does not reveal the specific payload, phishing kit, or compromised credentials that may have been collected. Uncertainty remains around the actual content served before takedown and whether additional infrastructure (such as redirectors or command‑and‑control servers) is associated with the same IP range.

Defenders should update their URL filtering and DNS block policies to include ip.airdrpsalert.click, monitor for any new subdomains resolved to the same IP, and consider adding the IP address 64.233.180.105 to reputation lists. Continuous re‑scanning of the domain and its IP is advised to detect any re‑activation or changes in certificate status. Incident response teams should also verify that any internal traffic to the domain is blocked and that logs are examined for prior access attempts that may indicate successful phishing attempts against users with Google credentials.