threshold[.]airdrpalerts[.]lol

Analysis of the domain threshold.airdrpalerts.lol indicates an elevated-risk brand impersonation campaign targeting Google. The domain was registered on October 25, 2025, through Dynadot LLC and currently resolves to the IP address 142.250.188.4, which is geolocated within AS15169 (Google LLC). This infrastructure alignment with the targeted brand may complicate detection for defenders relying on hosting mismatches as a signal. The domain uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure origin servers and evade IP-based blocking. No SSL certificate is present, which may serve as an additional indicator for automated detection systems.

Security vendor detections are limited but non-zero: 11 of 95 engines on VirusTotal flagged the domain at the time of assessment. The domain appears on one security blocklist and is specifically blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, further supporting its classification as malicious. The page title, 'Google,' directly corresponds to the brand impersonation type documented in available intelligence. Defenders should note that the domain is currently offline, though this status may change.

The absence of an SSL certificate, combined with the use of Cloudflare and a registration date nearly nine months prior to this report, suggests the domain may have been staged for intermittent use. Infrastructure analysis reveals no evidence of a phishing kit or payload delivery, but the page title and scam type indicate the intent was to deceive users into believing they were interacting with a legitimate Google service. Monitoring for DNS reactivation or changes in nameserver configuration is recommended, as is cross-referencing the IP 142.250.188.4 and registrar Dynadot for related domains. Automated systems should treat domains with similar characteristics—Cloudflare nameservers, no SSL, and alignment with major brand IPs—as high-priority for review.