flow[.]airdrpsalerts[.]info

Analysis of the domain flow.airdrpsalerts.info indicates it was actively involved in brand impersonation targeting Google, as of July 23, 2026. The domain resolved to the IP address 142.250.185.100, which is associated with AS15169 (Google LLC) in the United States, though this does not confirm hosting by Google itself. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., a common tactic to obscure ownership and evade takedowns. No SSL certificate was detected, increasing the likelihood of interception or misuse of transmitted data. The domain's nameservers were unresponsive or missing, a red flag for misconfigured or abandoned phishing infrastructure.

The page title captured from the domain was 'Google,' aligning with the reported scam type of brand impersonation. While the exact content of the site remains unanalyzed, the combination of the page title and scam classification strongly suggests an attempt to mimic Google's branding. Detection data shows the domain was flagged by 12 of 95 security vendors on VirusTotal, and it appears on at least one security blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, further indicating malicious intent.

As of the report date, the domain has been taken offline, though defenders should remain vigilant for re-registration or migration to alternative infrastructure. The lack of SSL, unresponsive nameservers, and low detection thresholds suggest this was a short-lived campaign, potentially part of a broader pattern of disposable phishing domains. Organizations are advised to block the domain at the DNS level and monitor for related indicators of compromise, such as the IP address 142.250.185.100 or domains registered through the same Cloudflare registrar. No additional evidence links or payload samples were available for deeper analysis.