eth[.]airdrpsalerts[.]lat

Analysis of eth.airdrpsalerts.lat shows a domain registered through Dynadot LLC on 2025-10-29 that has been taken offline. The site presented a page title of "Google" and is classified as a brand‑impersonation campaign targeting Google. No SSL certificate was observed, indicating the site was served over plain HTTP before removal. DNS resolution points to IP address 142.250.185.100, which belongs to AS15169 owned by Google LLC and is located in the United States.

The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common pattern for fast‑flux or anonymised hosting. VirusTotal recorded eight detections out of ninety‑five scanning engines, and the domain appears on a single external blocklist. PhishDestroy has already blocked the domain, and Gridinsoft assigns it a trust score of zero out of one hundred, reinforcing the malicious assessment. Although the site is currently offline, the presence of Google‑owned IP infrastructure combined with a lack of TLS, a generic page title, and multiple vendor detections suggests intentional masquerading of a legitimate brand to lure victims.

Uncertainty remains regarding the specific malicious payload, phishing kit, or any credential‑harvesting functionality because no content analysis or URL paths have been disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the IP address to threat‑intel feeds. Ongoing vigilance is recommended for any traffic or DNS queries involving the same Cloudflare nameservers or the associated IP range, as attackers may repurpose the infrastructure for future impersonation campaigns.