abstract[.]airdrpsalert[.]lat

Analysis of the domain abstract.airdrpsalert.lat indicates a brand impersonation campaign targeting Google, first registered on October 26, 2025, through Dynadot LLC. The domain is currently offline, but prior scans revealed it presented a page titled 'Google,' aligning with the identified scam type of brand impersonation. No SSL certificate was detected, increasing the likelihood of unencrypted communication. The domain appeared on one security blocklist, and 14 of 95 security vendors on VirusTotal flagged it as malicious, though the exact nature of the payload remains unverified.

Infrastructure analysis shows the domain resolved to IP 142.250.185.132, hosted on AS15169 (Google LLC), which may indicate either legitimate redirection or abuse of Google infrastructure. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com suggest Cloudflare was used for DNS management, though it is unclear whether Cloudflare services were actively protecting the domain at the time of detection. Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk classification.

Defenders should treat this domain as a confirmed phishing vector, particularly for campaigns impersonating Google services. While the domain is offline, monitoring for re-registration or related infrastructure (e.g., subdomains, reused IPs, or nameservers) is recommended. No evidence links this domain to a specific phishing kit or broader campaign, and the exact content served remains unanalyzed.