usual[.]airdrpsalert[.]sbs

The domain usual.airdrpsalert.sbs was registered on October 22, 2025 through Dynadot LLC and is presently offline. Infrastructure analysis shows the domain resolves to the IPv6 address 2a00:1450:4001:80f::2004, which belongs to the AS15169 Google LLC network and is geolocated in Germany. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate was observed for the site, meaning HTTPS was not enforced at the time of capture. The page title returned by the server is "Google," and the scam type is identified as brand impersonation targeting Google, consistent with the declared brand target.

Reputation signals are uniformly negative. The Gridinsoft trust score is 0 out of 100, indicating a complete lack of trust. VirusTotal records show that 13 of 95 scanned security vendors flagged the domain, demonstrating a measurable detection rate across multiple engines. The domain appears on one public security blocklist and is explicitly blocked by the PhishDestroy mitigation platform. The overall risk level has been assigned as elevated.

While the site is no longer reachable, the observed indicators suggest a deliberate attempt to exploit Google’s brand reputation. Defenders should continue to monitor the associated IPv6 address and the Cloudflare name servers for any re‑activation, incorporate the domain and its resolving IP into blocklists, and ensure that endpoint protection solutions reference the VirusTotal detection count. Because the site lacks an SSL certificate, any future deployment would likely continue to operate over plain HTTP, simplifying detection via network‑level inspection. No additional malicious payloads or secondary infrastructure have been identified, so further investigation should focus on traffic patterns to the IPv6 address and any related domains that share the same name server configuration.