mon[.]airdrpsalert[.]lol

Analysis of the domain mon.airdrpsalert.lol indicates it was actively impersonating Google, as evidenced by the page title 'Google' and its classification as a brand impersonation threat. The domain was registered on October 22, 2025, through Dynadot LLC and resolved to the IPv6 address 2607:f8b0:4004:c0b::93, which is part of Google LLC's network (AS15169) located in the United States. Despite the IP's association with Google, the domain itself was hosted behind Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns.

No SSL certificate was present, which is unusual for legitimate services but consistent with hastily deployed phishing infrastructure. As of the report date, the domain was taken offline, though its prior activity was flagged by 12 of 95 security vendors on VirusTotal and appeared on one security blocklist (PhishDestroy). The combination of a Google-branded page title, lack of encryption, and detection by multiple vendors strongly suggests malicious intent.

Defenders should treat this domain as part of a phishing campaign targeting Google users, particularly given its alignment with known brand impersonation patterns. While the domain is currently inactive, historical DNS records and detection data should be preserved for correlation with future threats. No additional scam category or kit details are confirmed, and the exact content of the phishing page remains unanalyzed.