send[.]airsdropsalerts[.]sbs

This domain is flagged for elevated risk due to targeted brand impersonation, specifically mimicking Gmail to facilitate credential theft. Analysis indicates the infrastructure was designed to deceive users into disclosing login credentials by presenting a fraudulent Google login interface, as evidenced by the page title 'Google' and the absence of an SSL certificate, which is atypical for legitimate authentication portals. Infrastructure analysis reveals the domain send.airsdropsalerts.sbs was registered on November 07, 2025, through Dynadot LLC. It resolves to the IP address 142.250.184.196, hosted on AS15169 (Google LLC), though this appears to be a misdirection or abuse of legitimate infrastructure. The domain is currently offline but was previously detected by 12 out of 95 security vendors on VirusTotal, indicating broad recognition of its malicious nature. It also appears on one security blocklist and was actively blocked by at least one anti-phishing system. The creation date suggests recent deployment, aligning with common phishing campaign timelines. To mitigate risks associated with this type of credential theft, organizations and users should implement multi-factor authentication (MFA) for all accounts, particularly those tied to email services. Network-level protections should include blocking the domain and its associated IP address at firewalls and DNS resolvers. Security teams should monitor for indicators of compromise, such as unexpected authentication attempts or anomalous login locations, and conduct retrospective analysis of logs for connections to 142.250.184.196 or send.airsdropsalerts.sbs. User education should emphasize verifying domain authenticity before entering credentials, especially for services like Gmail, and reporting suspicious login pages to IT security teams.