mon[.]airdrpsalert[.]sbs

Analysis as of July 23 2026 shows that mon.airdrpsalert.sbs was registered through Dynadot LLC on 22 October 2025 and is configured to use Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The domain resolves to the IPv6 address 2607:f8b0:4004:c0b::93, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. No TLS certificate is presented, indicating that the site was served without encryption.

The HTTP response returned a page title of "Google", matching the declared impersonation target. Eight of ninety‑five security vendors on VirusTotal flagged the domain, suggesting malicious intent, and the domain is listed on a single security blocklist and has been blocked by the PhishDestroy service. The domain currently shows an offline status, and no additional payloads, scripts, or redirect behavior have been observed.

Defenders should monitor for any re‑activation of the host, enforce blocking of the domain at network perimeter, and consider adding the IPv6 address to deny lists. Further investigation should include active probing to confirm whether the site serves credential‑collection pages and to capture any associated network traffic. The lack of an SSL certificate and the use of Google‑owned infrastructure may be an attempt to lend credibility, but the flagged vendor detections and blocklist presence indicate a credible brand‑impersonation threat.