cetus[.]airdrpsalerts[.]lat

Analysis of the domain cetus.airdrpsalerts.lat indicates a brand impersonation campaign targeting Facebook users, classified with an elevated risk level. The domain was registered on October 29, 2025, through Dynadot LLC and currently resolves to the IP address 172.253.115.105, which is hosted on Google LLC's infrastructure (AS15169) in the United States. Cloudflare nameservers, brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, are associated with the domain, a configuration commonly observed in both legitimate and malicious infrastructure. The domain appears on one security blocklist, specifically PhishDestroy, and has been flagged by 7 of 95 security vendors on VirusTotal, suggesting detection by multiple engines.

The page title 'Google' does not align with the identified brand target, Facebook, which may indicate an attempt to mislead automated detection systems or users. No SSL certificate was present at the time of assessment, further reducing the domain's legitimacy indicators. The domain is currently offline, though its prior operational status and detection history warrant continued monitoring. Defenders should treat this domain as part of a broader pattern of Facebook-branded phishing campaigns.

The use of Cloudflare nameservers and Google-hosted infrastructure may complicate takedown efforts, as these services are frequently leveraged by both legitimate and malicious actors. Organizations are advised to block the domain and its resolving IP at the network level, update endpoint protection rules to include this indicator, and monitor for related domains registered through the same registrar or utilizing similar naming conventions. Given the domain's detection history and blocklist presence, it should be considered compromised until further evidence suggests otherwise.