nexusmutual[.]airdrpsalert[.]lol

Analysis of the domain nexusmutual.airdrpsalert.lol shows it was registered on 22 October 2025 through Dynadot LLC and is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The site resolves to IP 142.250.184.228, which is owned by AS15169 Google LLC and located in the United States, indicating the attacker leveraged legitimate Google infrastructure to increase trust. No TLS certificate is presented, leaving the connection unencrypted. The only visible page element is the title “Google”, matching the declared brand target and confirming the classification as a brand‑impersonation campaign.

VirusTotal scans have flagged the domain in 12 of 95 security vendors, and PhishDestroy has already placed it on a blocklist. Independent scoring from Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one additional security blocklist. The site is currently taken offline, but the historical evidence suggests a short‑lived phishing operation that relied on IP spoofing and reputable hosting to evade casual inspection.

Uncertainties remain regarding the exact phishing payload, user‑facing content, and whether the domain was used in conjunction with other malicious infrastructure, as no content capture or HTTP response details are available. Defenders should immediately add nexusmutual.airdrpsalert.lol to URL filtering and DNS blocklists, monitor for any re‑registration of the same second‑level domain, and consider extending detection rules to include domains that resolve to Google’s AS15169 address while lacking TLS. Continuous review of Cloudflare‑hosted domains that present brand‑related page titles without valid certificates is recommended to catch similar impersonation attempts in their early stages.