polkadot[.]airdrpsalert[.]sbs

polkadot.airdrpsalert.sbs was observed as a brand‑impersonation site targeting Google. The domain was registered on October 22 2025 through Dynadot LLC and uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to 142.250.185.132, an address owned by AS15169 Google LLC located in the United States. No TLS certificate was presented, indicating the site was served over plain HTTP.

The page title returned “Google”, matching the declared brand target and the listed scam type of brand impersonation. The domain is currently taken offline, but it remains listed on one security blocklist and has been actively blocked by the PhishDestroy feed. Gridinsoft assigns a trust score of 0 / 100, reflecting a high confidence of malicious intent. VirusTotal reports three positive detections out of ninety‑five scanners, confirming that multiple independent engines flagged the domain.

The combination of a Google‑owned IP, absence of encryption, a generic “Google” title, and low trust score suggests the site was intended to lure victims into credential harvesting or other Google‑related fraud. Defenders should add the domain to blocklists, monitor DNS queries for the associated IP, and ensure that any internal redirects to the address are denied. Continued observation of the hosting infrastructure and the Cloudflare name servers is advised, as the operator may reuse the same resolver configuration for future impersonation campaigns.