dfi[.]airdrpsalert[.]lat

Analysis of the domain dfi.airdrpsalert.lat indicates a confirmed brand impersonation campaign targeting Facebook users, classified as elevated risk. The domain was registered on October 26, 2025, through Dynadot LLC and is currently offline. Infrastructure analysis reveals Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com) and resolution to IP 142.250.186.132, hosted on Google LLC's network (AS15169) in the United States. No SSL certificate was detected, increasing susceptibility to interception.

The page title 'Google' contradicts the declared Facebook impersonation, suggesting either misconfiguration or deliberate obfuscation of the actual phishing content, which remains unconfirmed due to the domain's offline status. Detection data is limited but indicative: two of 95 security vendors on VirusTotal flagged the domain, and it appears on one security blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0/100, reinforcing the malicious classification.

While the domain is currently inactive, defenders should treat it as a confirmed phishing resource due to its registration details, hosting infrastructure, and detection history. Organizations are advised to block the domain at DNS and proxy levels, monitor for reactivation, and correlate with related indicators such as the hosting IP and nameserver pair. The absence of an SSL certificate and the mismatch between page title and declared brand target warrant heightened scrutiny for similar domains using this infrastructure.