usual[.]airdrpsalert[.]lat

This report details a newly registered domain, usual.airdrpsalert.lat, which presents an impersonation threat. The site's page title is "Google" and it is designed to impersonate the Gmail brand. The primary threat is that the site attempts to deceive users into believing they are accessing a legitimate Gmail service, likely to harvest credentials or personal information through a phishing scheme.

Technical evidence confirms the malicious nature of this domain. VirusTotal flagged the site with 5 detections out of 95 vendors, indicating malicious activity. It was flagged by ChainPatrol, CRDF, G-Data, SOCRadar, and Sophos. The domain is hosted on IP address 142.250.185.196, located in the United States and belonging to AS15169 Google LLC. The domain was created on 2025-10-26 through registrar Dynadot LLC. It has no SSL certificate and uses nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

The current status of the domain is DOWN or OFFLINE, meaning it is not accessible. Its GridinSoft trust rating is 0 out of 100, and the DOM risk score is 25. Based on this evidence, the risk level is assessed as moderate, as the domain is currently inactive but was clearly established for malicious impersonation purposes.