metis[.]airdrpsalert[.]cfd

Analysis of the domain metis.airdrpsalert.cfd indicates that it was created on 22 October 2025 and is currently taken offline. The domain resolves to the IP address 142.251.179.147, which is registered to AS15169 Google LLC and geolocated to the United States. The hosting infrastructure is behind Cloudflare, as evidenced by the authoritative name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No SSL/TLS certificate is presented for the site, meaning HTTPS connections would be unencrypted or would fail to negotiate a secure session.

The page title returned from the HTTP response is the generic string "Google", matching the declared brand target of Google. Registration was performed through Dynadot LLC, a registrar commonly used for both legitimate and malicious domains. VirusTotal scans show that nine of ninety‑five security engines flag the domain as malicious, and the site appears on a single external blocklist, where it has been indexed by PhishDestroy. The risk rating assigned is elevated, reflecting the combination of brand impersonation, lack of encryption, and detection by multiple vendors.

While the site is no longer reachable, defenders should maintain a watch on the associated IP address and the Cloudflare name servers, as they may host additional malicious payloads. Blocking the domain at DNS or proxy layers, updating URL filtering policies to include the observed host, and monitoring for new subdomains registered under the same registrar are recommended mitigation steps. Further investigation is needed to determine whether the domain previously served a credential‑harvesting page or other Google‑related content, as the current evidence does not include a content snapshot.