airdrpsalerts[.]lat

Analysis of airdrpsalerts.lat indicates a high-risk brand impersonation domain targeting Google, currently offline as of July 23, 2026. The domain was registered on October 29, 2025, through Dynadot LLC and uses Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com). It resolves to IP 142.250.186.100, geolocated in Germany under AS15169 (Google LLC), though this does not confirm legitimate association. No SSL certificate was detected. The page title, as captured in available metadata, is 'Google,' aligning with the reported brand impersonation scam type.

Detection data shows 13 of 95 security vendors on VirusTotal flagged the domain as malicious. It appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Gridinsoft assigns a trust score of 0/100. AlienVault OTX lists the domain in one threat intelligence pulse, suggesting prior malicious activity. No evidence confirms the specific phishing kit or payload used, and the exact content of the site remains unanalyzed.

Defenders should treat this domain as confirmed malicious due to brand impersonation, detection vendor flags, and blocklist presence. The absence of SSL and use of Cloudflare nameservers are consistent with phishing infrastructure, though not definitive alone. Network-level blocking is recommended, and retrospective log analysis should check for connections to 142.250.186.100 or the domain since its creation date. Further investigation may reveal additional linked infrastructure or campaigns.