tia[.]airdrpalert[.]click

On July 22 2026, threat analysts examined the domain tia.airdrpalert.click, which was registered on October 30 2025 through Dynadot LLC. The domain resolves to IP address 142.250.181.228, an address owned by Google LLC and listed under ASN 15169, indicating that the infrastructure leverages legitimate Google hosting resources. No SSL certificate was observed, so the site operates without HTTPS protection. The page title returned by the HTTP response is simply "Google," and the domain is explicitly classified as a brand impersonation of Google. Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com are authoritative for the domain, a common pattern for fast‑flux or abuse of reputable DNS services.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal analysis shows that three of ninety‑five security vendors flagged the domain, and it appears on at least one public blocklist, confirming that independent scanners have identified it as suspicious. PhishDestroy has already taken the domain offline, and the current status is reported as taken offline.

While the available data confirms the domain’s use for brand impersonation and its association with Google‑owned IP space, the exact content of the site, such as login forms or malicious payloads, has not been captured, leaving the precise attack vector uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and consider adding the domain to internal threat‑intel feeds. Ongoing observation of related Cloudflare‑hosted domains and rapid response to similar brand‑impersonation patterns are recommended to mitigate potential future abuse.