plume[.]airdrpsalert[.]locker

Analysis of plume.airdrpsalert.locker shows a recently created domain (registered 26 October 2025) that is being used for a Facebook brand‑impersonation campaign. The site resolves to 142.251.140.164, an address owned by Google LLC (AS15169) in the United States. DNS resolution is handled by two Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com). No TLS certificate is presented, indicating the site is served over plain HTTP only. The page title returned by a simple HTTP request is "Google", which does not correspond to the advertised Facebook target, suggesting a mismatch that may be used to evade cursory checks.

The registrar listed is Dynadot LLC, a common registrar for malicious infrastructure. The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal reports eight positive detections out of ninety‑five scanned security vendors, confirming that multiple scanners have identified the host as malicious. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the low credibility of the site. Current operational status is reported as offline, but the presence of the domain in blocklists and the detection counts indicate that it was active at some point and may be re‑activated by the threat actors.

Defenders should add the domain and its resolved IP address to outbound and inbound filtering rules, monitor DNS queries for the associated Cloudflare nameservers, and consider flagging any future registrations from the same registrar that target the same brand. Continuous watch of the IP range owned by Google for anomalous traffic patterns is advisable, as the infrastructure may be shared with legitimate services. Indicators of compromise (IOC) include the domain name plume.airdrpsalert.locker, the IP 142.251.140.164, the Cloudflare nameservers, and the lack of an SSL certificate.