mole[.]airdrpalert[.]click

Analysis of mole.airdrpalert.click shows that the domain was registered through Dynadot LLC on October 30 2025 and is currently resolved to the IP address 142.250.185.100, which belongs to the AS15169 Google LLC network located in the United States. The domain uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating that the attacker leveraged a reputable CDN provider to hide the true origin of the host. No SSL/TLS certificate is presented for the site, meaning HTTP connections would be unencrypted. The page title returned by the server is “Google”, and the intelligence feed flags the domain as impersonating the Google brand. VirusTotal scans have recorded three detections out of ninety‑five submitted engines, and the domain appears on at least one public blocklist.

PhishDestroy has also listed the domain as blocked. The site’s current status is offline, which may be the result of takedown actions or a temporary shutdown by the operators. Evidence confirms that the infrastructure points to a legitimate Google‑owned IP range, a technique often used to increase credibility and evade reputation‑based filters. However, the lack of a valid TLS certificate and the presence of brand‑impersonation indicators suggest malicious intent.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms because the page content has not been captured. Defenders should continue to block the domain at network perimeter devices, monitor DNS queries for the domain and its associated name servers, and add the IP address 142.250.185.100 to watchlists despite its legitimate ownership. Additional sandbox analysis of any downloaded payloads or URLs observed in related campaigns would be required to fully characterize the threat. Organizations using Google services should remain vigilant for unsolicited communications that reference the domain, even though the site is presently offline.