sca[.]airdrpsalert[.]club

Analysis of the domain sca.airdrpsalert.club indicates it was actively engaged in brand impersonation targeting Google, as evidenced by its page title 'Google' and explicit classification in threat intelligence sources. The domain was registered on October 26, 2025, through Dynadot LLC and resolved to the IP address 142.250.185.132, which is part of AS15169 (Google LLC) infrastructure located in the United States. Despite the hosting IP's association with Google, the domain itself lacked an SSL certificate and was flagged by at least one security blocklist. PhishDestroy classified this domain as malicious prior to its takedown.

VirusTotal data shows 13 of 95 security vendors marked the domain as malicious, though the specific detection rules or payloads are not detailed in available intelligence. The domain's nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) suggest Cloudflare was used for DNS management, a common tactic to obscure hosting details. As of the report date, the domain is offline, but its prior activity and infrastructure warrant retrospective review.

Defenders should treat any prior connections to this domain as high-risk events, particularly if aligned with Google-branded phishing campaigns. The absence of SSL and the use of a major cloud provider's IP space highlight the need to monitor for similar impersonation attempts leveraging trusted infrastructure. No further content analysis (e.g., phishing kit, payload delivery) is available from the provided data.