metis[.]airdrpsalert[.]lat

Analysis of the domain metis.airdrpsalert.lat confirms its classification as a brand-impersonation phishing site targeting Google. The domain was registered on October 26, 2025, through Dynadot LLC, a registrar frequently observed in phishing infrastructure. Infrastructure analysis reveals the domain resolves to the IP address 142.250.185.228, which is geolocated in the United States and associated with AS15169, an autonomous system operated by Google LLC. This IP resolution is atypical for a phishing domain, as it does not align with common bulletproof hosting providers or anonymized services, though it does not preclude malicious use. No SSL certificate was detected for the domain, increasing the likelihood of interception or detection by security controls. The page title captured from the domain is 'Google,' directly indicating an attempt to impersonate the Google brand.

As of the report date, the domain has been flagged by 2 of 95 security vendors on VirusTotal, suggesting limited but present detection. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, which further corroborates its malicious classification. The domain's nameservers, brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, are associated with Cloudflare, a service often leveraged by threat actors to obscure hosting origins and evade takedowns. The domain is currently offline, which may indicate successful mitigation efforts or a temporary cessation of operations by the threat actor.

However, the infrastructure remains registered and could be reactivated. Defenders are advised to monitor for re-emergence of this domain or similar variants registered through the same registrar or utilizing the same nameserver configuration. Network-level blocking of the domain and its associated IP address is recommended for organizations seeking to prevent potential credential harvesting or brand abuse.