scr[.]airdrpsalert[.]lat

scr.airdrpsalert.lat was observed delivering a Google brand impersonation campaign. The domain, registered through Dynadot LLC on 26 October 2025, resolves to the IP address 142.250.185.132, which belongs to AS15169 (Google LLC) and is geolocated in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No HTTPS certificate was presented, indicating the site was served over plain HTTP.

The only visible page element, as captured by the title tag, is the word “Google”, matching the declared target brand. VirusTotal recorded detections from two of ninety‑five scanners, and the domain appears on a single external blocklist that is also referenced by the PhishDestroy feed. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious classification.

The site’s status is currently offline, but the underlying hosting infrastructure – a Google‑owned IP address – may be repurposed for future campaigns. Defenders should add scr.airdrpsalert.lat to block lists, monitor DNS queries for the associated IP and nameservers, and consider tightening outbound filtering for traffic to Google‑owned address space that is not otherwise expected. Continuous re‑evaluation is advised, as the domain could be re‑activated or a similar pattern reused in new impersonation attempts.