usual[.]airsdropsalerts[.]sbs

On July 23, 2026, the domain usual.airsdropsalerts.sbs was flagged as a Google brand‑impersonation campaign. The site was registered through Dynadout LLC on November 7 2025 and uses the Cloudflare authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to 142.250.185.228, an address owned by AS15169 Google LLC located in the United States. No TLS certificate was presented, indicating that the site served only HTTP. The page title returned by the server is the literal string “Google”, matching the declared target brand.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single external blocklist that subsequently listed it in PhishDestroy’s takedown list. VirusTotal scanned the domain and 11 of 93 security engines reported it as malicious, reinforcing the suspicion of abuse. The current HTTP status is offline, suggesting that the hosting provider or takedown actions have removed the content. Evidence confirms the use of legitimate Google‑owned infrastructure for hosting, a tactic often employed to increase credibility and evade reputation‑based filters. However, the lack of an SSL certificate and the minimal blocklist exposure indicate a short‑lived operation, possibly targeting opportunistic victims before detection.

The exact page content, credential‑capture mechanisms, and any additional payloads remain unknown because the site is no longer reachable and no screenshots have been captured. Defenders should add usual.airsdropsalerts.sbs to internal block and deny lists, monitor the associated IP address for any future reuse, and enforce strict outbound filtering for HTTP traffic to that host. Network sensors should be configured to alert on DNS queries for the domain or its nameservers. Because the infrastructure leverages a Google AS, additional scrutiny of outbound connections to AS15169 may help identify similar abuse.