mon[.]airdrpsalert[.]life

On July 25 2026 the domain mon.airdrpsalert.life was identified as a brand‑impersonation site targeting Google. DNS resolution points the domain to IP 142.250.185.164, an address owned by AS15169 Google LLC in the United States. The hosting information suggests the attacker leveraged a legitimate Google‑owned IP, a tactic that can increase trust in automated URL reputation checks. The domain was registered through Cloudflare, Inc., but the authoritative nameservers could not be retrieved (NS_NOT_FOUND), limiting visibility into the registration details. No TLS certificate was presented, indicating the site was served over plain HTTP or is currently offline.

HTTP probing confirms the site is presently taken offline, and no further page content beyond the HTML title "Google" has been captured. VirusTotal analysis recorded ten detections out of ninety‑five scanning engines, reflecting moderate consensus among vendors that the domain is malicious. Independent blocklist feeds have already added the domain to two phishing‑related lists: PhishDestroy and ScamSniffer. Both lists classify the site as a brand‑impersonation vector, reinforcing the vendor detections. No Safe Browsing or Open Threat Exchange entries were observed in the supplied data.

Given the limited exposure—offline status, missing SSL, and unavailable nameserver data—full behavioural characteristics remain uncertain. However, the combination of a Google‑owned IP address, a page title explicitly naming the target brand, and multiple vendor flags constitutes strong evidence of a targeted impersonation campaign. Defensive teams should block the domain at DNS and proxy layers, add the associated IP address to reputation‑based deny lists, and monitor for future registrations that resolve to the same IP range. Continuous re‑evaluation is advised in case the site returns to service or new indicators emerge.