airdrpsalert[.]locker

This domain was observed in multiple threat feeds and is currently offline. airdrpsalert.locker was registered on 2025-10-26 through Dynadot LLC and resolves to the IPv4 address 142.250.185.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. No TLS certificate was presented during connection attempts, meaning the site was served over plain HTTP only.

The page title returned by the web server is “Google”, which does not correspond to the advertised brand target of Facebook and therefore provides no direct indication of the malicious content that may have been displayed. The domain is listed on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating consensus among community-driven mitigation platforms that the host is associated with brand-impersonation activity. VirusTotal recorded detections from seven of ninety-five scanned security vendors, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the classification as high-risk. AlienVault OTX references the domain in a single threat-intel pulse, further corroborating its presence in open-source intelligence.

Given the combination of a recent registration, use of a reputable hosting provider, absence of encryption, and multiple independent detections, defenders should treat any traffic to airdrpsalert.locker as malicious. Network sensors should block the IP 142.250.185.196 and the domain name, DNS resolvers should enforce deny-list policies for the four blocklists, and endpoint protection solutions should incorporate the VirusTotal detection signatures. Continuous monitoring of the associated IP range and Cloudflare nameservers is advised, as the infrastructure may be repurposed for future campaigns targeting Facebook users.