airdrpalert[.]lat

Analysis indicates that the domain airdrpalert.lat was registered on October 30, 2025 through Dynadot LLC and currently resolves to the IP address 172.253.62.106, which belongs to AS15169 owned by Google LLC in the United States. The domain is hosted on Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but it does not present an SSL/TLS certificate, causing HTTP connections to be unencrypted. The site title returned by the server is "Google", matching the declared brand target of Google and confirming the classification as a brand‑impersonation campaign. The domain has been taken offline at the time of reporting, yet it remains listed on a single security blocklist, specifically PhishDestroy, and appears in one AlienVault OTX pulse.

VirusTotal analysis shows that 11 of 95 scanned security vendors flagged the domain, indicating a moderate detection consensus. Reputation services assign extremely low trust scores, with Scamadviser reporting 1 / 100 and Gridinsoft 0 / 100. No additional evidence such as malware payloads, phishing landing‑page screenshots, or certificate details is available, leaving the exact content and user‑interaction mechanisms unverified.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation, and consider adding the domain to internal blacklists. The association with Google’s IP space may cause false‑positive alerts; therefore, correlation with the observed blocklist entries and the brand‑impersonation indicator is recommended before taking remediation actions. Ongoing verification of the domain’s status and periodic re‑scanning with multi‑vendor engines are advised to capture any changes in its threat posture.