dot[.]airdrpalerts[.]lol

Analysis of dot.airdrpalerts.lol indicates a short-lived infrastructure used for brand impersonation targeting Google users. The domain was registered on October 25, 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to IP address 142.251.40.228, which belongs to AS15169 Google LLC and is located in the United States. The presence of Google-owned IP space may have been intended to lend credibility, but the domain itself does not host any TLS certificate, suggesting an unencrypted HTTP service when it was active.

The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy, confirming external detection of malicious intent. VirusTotal scans show five of ninety‑five security vendors flagging the domain, reinforcing the suspicion of abuse. Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com were observed, a common choice for rapid domain provisioning. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious behavior.

The page title returned "Google," matching the declared brand target and confirming the impersonation claim. While the site is no longer reachable, defenders should continue to block the domain at the network perimeter, monitor the associated IP for any future activity, and update URL filtering rules to include this indicator of compromise. Ongoing vigilance for similarly structured domains that resolve to reputable IP ranges is recommended to mitigate reuse of this technique.