mole[.]airdrpsalert[.]sbs

This domain, mole.airdrpsalert.sbs, was observed to resolve to the IPv4 address 142.250.185.100, which is allocated to AS15169 Google LLC and located in the United States. The domain was registered on October 22, 2025 through Dynadot LLC and is delegated to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was presented during inspection, indicating that the site was served over plain HTTP. The HTTP response contained a page title of “Google”, matching the declared brand target of Google and confirming a brand‑impersonation intent. VirusTotal analysis reported that three of ninety‑five scanned security vendors flagged the domain as malicious, and the domain is listed on a single external blocklist.

PhishDestroy has also recorded the domain as blocked. The current operational status is offline, and the risk level has been assessed as elevated. Analysis of the available artefacts suggests that the infrastructure leverages a Google‑owned IP address, which may be intended to lend credibility to the counterfeit page. The lack of a TLS certificate reduces the likelihood of a credential‑harvesting login portal, but the presence of a Google page title and brand targeting indicates a possible lure for users searching for legitimate Google services.

Attribution of the payload or further malicious behavior cannot be confirmed due to the offline status and absence of additional telemetry. Defenders should add mole.airdrpsalert.sbs to URL filtering rules, block the associated IP 142.250.185.100 for this domain context, and monitor for future registrations that reuse the same second‑level and third‑level patterns. Continuous watch of Dynadot‑registered domains and Cloudflare nameserver configurations is recommended, as is periodic re‑scanning with VirusTotal or comparable multi‑engine services to capture any changes in detection ratings.