recall[.]airdrpsalert[.]bond

Analysis of recall.airdrpsalert.bond indicates a brand impersonation campaign targeting Google. The domain was registered on October 26, 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to the IPv6 address 2a00:1450:4001:811::2004, which belongs to AS15169 (Google LLC) and is geolocated in Germany. Nameserver delegation to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com shows the use of Cloudflare's DNS service, a common choice for fast deployment and concealment of infrastructure.

The site presented a page title of "Google," matching the declared brand target, and no TLS certificate was observed, meaning the site operated without HTTPS encryption. Security telemetry records the domain on a single blocklist and confirms that PhishDestroy has blocked it. VirusTotal analysis shows that 2 of 95 scanned security vendors flagged the domain, suggesting a modest level of detection at the time of scanning. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification.

While the exact content of the page remains unverified due to the offline status, the combination of brand impersonation, Cloudflare DNS, Google‑owned IP space, and low trust scoring collectively support the assessment of an active phishing vector. Defenders should continue to block the domain, monitor for any re‑registration or similar domains using the same Cloudflare nameservers, and consider adding the IPv6 address range associated with AS15169 to threat‑intelligence feeds. Additional observation of DNS queries for similar patterns can aid in early detection of related campaigns.