ip[.]airdrpsalert[.]lol

Analysis of ip.airdrpsalert.lol shows a clear pattern of brand impersonation targeting Google. The domain was registered on October 22, 2025 through Dynadot LLC and resolves to the IPv6 address 2607:f8b0:4004:c07::6a, which is owned by AS15169 Google LLC and located in the United States. Despite the legitimate‑looking IP range, the domain uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and does not present an SSL certificate, leaving the connection unencrypted. The page title returned by the host is simply "Google," matching the declared brand target.

Security profiling indicates that three of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external blocklist. PhishDestroy has already added the domain to its blocklist, confirming that threat‑intel communities recognize it as malicious. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of high risk. The site is currently offline, so no HTTP response can be observed, but the infrastructure elements remain active and could be re‑used.

Defenders should immediately block the domain and its associated IPv6 address at perimeter and DNS filtering layers. Continuous monitoring of the Cloudflare name servers for any re‑activation is advised, as well as inclusion of the domain in internal threat‑intel feeds. Given the brand impersonation intent, any outbound traffic to this host should be logged and investigated for potential credential harvesting attempts.