mon[.]airdrpsalert[.]cfd

This domain, mon.airdrpsalert.cfd, was registered through Dynadot LLC on 22 October 2025 and points to the IP address 142.250.184.196, which belongs to AS15169 Google LLC in the United States. The authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com resolve the domain, but the site does not present an SSL certificate, indicating that HTTPS is not configured. The page title returned by the HTTP response is “Google”, matching the declared brand target and confirming that the domain is being used for brand impersonation of Google. VirusTotal scans have recorded 14 positive detections out of 95 security‑engine submissions, and the domain is listed on two public blocklists that are actively used by PhishDestroy and ScamSniffer, both of which have already blocked the host.

Current network telemetry shows the domain is taken offline, and no live HTTP service was observed at the time of analysis. The combination of a recent registration date, a Google‑owned IP address, lack of TLS, and multiple vendor detections suggests the domain was likely deployed as a short‑lived phishing or credential‑harvesting vector that leveraged the trusted Google IP reputation to increase deliverability. Because the hosting infrastructure resides on Google’s network, traditional IP‑based blocking could generate false positives for legitimate Google services; therefore defenders should prioritize domain‑level indicators such as the exact hostname, the associated Cloudflare nameservers, and the observed page title when constructing block rules.

Continuous monitoring of the two blocklists that have already flagged the host, as well as periodic re‑scans on VirusTotal, is recommended to detect any re‑activation. In environments where web filtering relies on SSL inspection, the absence of a certificate may allow the request to pass uninspected; adding the domain to URL filtering lists mitigates this risk. Overall, the available evidence confirms that mon.airdrpsalert.