ip[.]airdrpsalert[.]lat

This domain, ip.airdrpsalert.lat, is identified as a brand impersonation threat specifically targeting Google. Analysis indicates the site masquerades as a legitimate Google service, as evidenced by its page title labeled 'Google.' The domain does not exhibit direct ties to known drainer kits but operates under the broader category of credential harvesting infrastructure. Infrastructure analysis reveals the domain was registered through Dynadot LLC on October 26, 2025, and resolves to the IP address 216.58.206.68. Detection metrics show 10 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on one additional security blocklist. Gridinsoft assigns a trust score of 0/100, and the domain is currently blocked by PhishDestroy. No entries were found in Google Safe Browsing at the time of assessment. The domain has been taken offline, reducing immediate exposure risks. However, residual threats persist due to its recent registration and prior malicious activity. Users who accessed the site should assume potential credential exposure and initiate password resets for associated accounts. Organizations are advised to monitor for related domains registered under the same registrar or resolving to the identified IP address, as threat actors frequently reuse infrastructure components across campaigns.