momentum[.]airdrpsalerts[.]xyz

This domain, momentum.airdrpsalerts.xyz, is flagged for brand impersonation targeting Google, as indicated by its page title 'Google' and confirmed by security vendor PhishDestroy. Infrastructure analysis reveals the domain was registered on November 4, 2025, through Dynadot LLC and currently resolves to the IPv6 address 2a00:1450:4001:830::2004, which is associated with Google LLC's autonomous system (AS15169) in Germany. The domain uses Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) but lacks an SSL certificate, a common red flag for fraudulent sites.

Detection data shows 16 of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. Despite its association with Google's IP range, this alignment is likely spoofed or misconfigured, as Google would not host impersonation domains on its infrastructure. The domain is currently offline, but defenders should treat any reactivation as high-risk.

No evidence of a phishing kit or specific scam mechanics is available, so the exact content remains unconfirmed. Defenders are advised to block the domain at DNS and proxy levels, monitor for re-registration or IP changes, and correlate with known Google-themed phishing campaigns. The absence of SSL and the use of Cloudflare nameservers further suggest an attempt to evade detection while maintaining operational flexibility.