mon[.]airdrpsalert[.]lat

mon.airdrpsalert.lat was registered through Dynadot LLC and first observed on 26 October 2025. The authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com resolve the domain to IP 216.58.206.68, which belongs to AS15169 Google LLC and geolocates to Germany. The HTTP response lacks an SSL certificate, indicating an unencrypted connection. The page title returned by the server is exactly “Google”, matching the declared brand target.

VirusTotal analysis shows that ten of ninety‑five scanning engines label the domain as malicious, and the domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer, both of which have already blocked it. The current operational status is offline, suggesting the site has been taken down or is otherwise unreachable. The available evidence points to a brand‑impersonation campaign that leverages a legitimate Google IP range to increase perceived trust, while presenting no TLS protection.

Although the site is presently offline, the infrastructure—particularly the use of Cloudflare nameservers and a Google‑owned IP address—demonstrates a deliberate attempt to evade detection. Defenders should continue to block the domain at network perimeter filters, monitor DNS queries for the domain and its associated nameservers, and consider adding the IP address to reputation‑based deny lists. Ongoing vigilance is advised to detect any re‑hosting of the same hostnames or similar brand‑impersonation attempts, especially given the elevated risk rating.