polkadot[.]airdrpsalerts[.]lat

Analysis of the domain polkadot.airdrpsalerts.lat indicates that it was used for a brand‑impersonation campaign targeting Google. The domain was registered through Dynadot LLC on 29 October 2025 and is hosted on the IPv6 address 2607:f8b0:4004:c07::68, which belongs to AS15169 (Google LLC) in the United States. DNS resolution points to Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate was observed, meaning the site operated without HTTPS.

The page title returned by the server was simply “Google”, matching the declared brand target. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one security blocklist. VirusTotal scanned the host and six of ninety‑five AV engines reported it as malicious. The phishing‑specific blocklist PhishDestroy has already taken the domain offline, and current checks confirm the site is no longer reachable.

Defenders should continue to block the domain at the DNS and network layers, monitor for any re‑registration attempts, and add the IPv6 address to deny lists. Because the infrastructure resides within Google’s own ASN, any future use may benefit from the same trusted network reputation, so vigilance is advised. The lack of SSL and the low trust score further corroborate the malicious intent. No additional content, such as login forms or payloads, has been publicly disclosed, so further forensic collection would be required to detail the exact phishing kit employed.