recall[.]airdrpsalerts[.]info

recall.airdrpsalerts.info was observed hosting a page whose title resolves to “Google”, matching the declared brand target of Google. The domain is registered through Cloudflare, Inc., and the DNS query returned no nameserver records (NS_NOT_FOUND). Resolution points to the IP address 142.250.186.68, which belongs to the AS15169 Google LLC network and geolocates to Germany. The hosting IP is therefore owned by the legitimate Google infrastructure, a pattern often exploited by threat actors to lend credibility to malicious pages. No TLS certificate was presented, indicating the site was served over plain HTTP.

On VirusTotal the domain received 12 positive detections out of 95 scanned security vendors, confirming that multiple scanners flagged it as malicious. It appears on a single external blocklist and is explicitly listed by PhishDestroy as a blocked resource. The Gridinsoft trust score of 0 / 100 further reflects a lack of trust. The classified scam type is “Brand Impersonation”, with the impersonated brand recorded as Google. The current online status is “taken offline”, meaning the site is no longer reachable, but the infrastructure artifacts remain useful for threat‑intel correlation.

Uncertainty remains around the exact content that was served before takedown, as no screenshot or HTML capture is available. Defenders should continue to block the domain and the associated IP address, add the domain to internal URL filtering lists, and monitor for any re‑registration or resurrection of the host. Correlation with other Cloudflare‑registered domains that resolve to Google‑owned IP space may reveal a broader campaign. Security teams should also verify that any corporate proxy or endpoint protection solution that references the PhishDestroy blocklist updates its signatures to include recall.airdrpsalerts.info, and they should consider sharing the indicator with threat‑sharing communities such as MISP.