hbar[.]airdrpsalert[.]lol

The domain hbar.airdrpsalert.lol is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page to deceive users into disclosing sensitive information, such as login credentials. No crypto drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk, but prior activity may still pose a threat to users who interacted with it.

Technical indicators confirm the malicious nature of hbar.airdrpsalert.lol. As of analysis, 2 of 95 VirusTotal security vendors flagged the domain, including ChainPatrol and SOCRadar. The domain was registered through Dynadot LLC on October 22, 2025, and resolves to the IP address 172.253.62.147, hosted on Google LLC's infrastructure (AS15169). It appears on one security blocklist, PhishDestroy, and has a Gridinsoft trust score of 0/100. No SSL certificate was issued for the domain, and the observed page title was 'Google'. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

Users who visited hbar.airdrpsalert.lol should take immediate safety steps. If login credentials were entered, change passwords for the affected account and any other services where the same credentials were reused. Enable two-factor authentication (2FA) to add an extra layer of security. Monitor accounts for unauthorized activity, such as unfamiliar transactions or login attempts. Report the phishing domain to Google’s Safe Browsing team via their reporting tool and to the registrar, Dynadot LLC, to aid in further takedown efforts.