arb[.]airdrpsalert[.]bond

The domain arb.airdrpsalert.bond was registered on October 26, 2025 through Dynadot LLC and is currently taken offline. Technical resolution shows the domain pointing to IP address 142.250.186.132, which is allocated to AS15169 Google LLC in the United States. The use of a Google‑owned IP range for a site that claims to impersonate Google raises the possibility of compromised or abused infrastructure, but the precise relationship between the attacker and the hosting network cannot be confirmed from the available data. No TLS certificate was presented, indicating that the site operated without encryption, which is consistent with many low‑effort impersonation attempts.

The HTTP response delivered a page title of "Google," directly matching the advertised brand target and reinforcing the classification as a brand‑impersonation campaign. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely poor reputation. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal analysis recorded detections from two of ninety‑five scanning engines, providing limited but concrete evidence of malicious activity.

Nameserver configuration uses brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑managed, which is a common choice for fast deployment of malicious sites. While the domain is no longer reachable, defenders should continue to monitor the associated IP address for any future abuse, add the domain to internal blocklists, and consider sinkholing traffic to prevent potential re‑use. Further investigation of the hosting environment and any related subdomains is advisable to determine whether the IP range is being leveraged for additional phishing infrastructure.