bnc[.]airdrpsalerts[.]lat

This domain is flagged as an elevated‑risk brand‑impersonation site targeting Google. The fully qualified domain bnc.airdrpsalerts.lat was registered on 2025-10-29 through Dynadot LLC and currently resolves to the IP address 142.250.184.196, which belongs to AS15169, Google LLC, United States. The hosting infrastructure uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating that the attacker leveraged a reputable DNS provider to mask the true origin of the traffic. No TLS certificate is presented, leaving the HTTP service unencrypted.

The site’s HTML title is simply “Google”, matching the declared brand target. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one known security blocklist. VirusTotal scans report that seven of ninety‑five AV engines flagged the domain, confirming malicious intent despite a relatively low detection count. PhishDestroy has already taken the domain offline, and the current status is listed as offline.

Uncertainty remains around the specific phishing kit or payload used, as no further page content has been disclosed. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated Cloudflare name servers, and add the IP address 142.250.184.196 to reputation‑based deny lists. Additional scrutiny of any outbound connections to this IP is advised, and security teams should update threat‑intel feeds with the indicator set (domain, IP, nameservers) to improve detection across the enterprise.