zircuit[.]airsdropalert[.]sbs

The domain zircuit.airsdropalert.sbs is a confirmed phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google service but is designed to deceive users into disclosing sensitive information through credential phishing. No crypto drainer kit was identified in this campaign. As of the latest verification, zircuit.airsdropalert.sbs has been taken offline.

Technical indicators confirm the malicious nature of zircuit.airsdropalert.sbs. The domain was registered through Dynadot LLC on November 05, 2025, and resolves to the IP address 142.250.185.228, hosted on Google LLC's infrastructure (AS15169). Security vendors flagged the domain, with 3 of 95 VirusTotal vendors detecting it as malicious, including ChainPatrol, SOCRadar, and Webroot. It appears on one security blocklist (PhishDestroy) and lacks an SSL certificate. The observed page title was 'Google,' reinforcing its impersonation attempt. Nameservers are hosted on Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com).

Users who interacted with zircuit.airsdropalert.sbs should immediately change any passwords entered on the site, particularly for Google accounts, and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google’s abuse reporting system and to platforms like PhishTank or the Anti-Phishing Working Group (APWG) to aid in broader takedown efforts. If financial or personal data was exposed, consider contacting relevant institutions to secure accounts.