s[.]airdrpalert[.]click

The domain s.airdrpalert.click was registered on October 30, 2025 through Dynadot LLC and is currently marked as taken offline. Infrastructure analysis shows the domain resolves to the IP address 142.250.186.100, which belongs to AS15169 Google LLC and is geolocated in Germany. Despite the legitimate ownership of the IP block, the domain is flagged as a brand impersonation targeting Google, as indicated by the page title "Google" and the declared scam type. The domain has no SSL certificate, which eliminates encrypted traffic protection and may facilitate interception.

Reputation checks reveal a Gridinsoft trust score of 0 out of 100, confirming an extremely low confidence level. VirusTotal reports that eight of ninety‑five security vendors have flagged the domain, providing independent confirmation of malicious activity. The domain appears on one security blocklist and has been blocked by the PhishDestroy service. Nameserver resolution is handled by brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑operated, suggesting the use of a reputable DNS provider to hide the true hosting intent.

The limited detection footprint, combined with the absence of SSL and the brand‑impersonation label, indicates a high likelihood of phishing or credential‑harvesting activity aimed at Google users. Defenders should add s.airdrpalert.click to URL filtering policies, block the associated IP address, and monitor for any related traffic patterns. Continuous verification of DNS changes and periodic rescans with multi‑vendor engines are recommended to capture any future re‑activation attempts.