bob[.]airdrpsalert[.]sbs

Analysis of bob.airdrpsalert.sbs shows a brand‑impersonation campaign targeting Google users. The domain was registered on October 22, 2025 through Dynadot LLC and resolves to the IP address 142.251.163.105, which is allocated to AS15169 Google LLC in the United States. Despite the legitimate‑looking IP, the domain does not present an SSL certificate, indicating that any traffic would be served over plaintext HTTP. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting that the operator leveraged Cloudflare DNS services for hosting.

The page title returned by the server is simply "Google," confirming the intent to mimic the brand, although no further page content has been publicly captured. VirusTotal scans show that eight out of ninety‑five security vendors flagged the domain as malicious, and it appears on at least one external blocklist. The domain has been taken offline, and the phishing‑specific blocklist PhishDestroy reports it as blocked. Current evidence does not reveal any additional infrastructure such as command‑and‑control servers, phishing kits, or payloads, leaving the exact delivery mechanism uncertain.

Defenders should add bob.airdrpsalert.sbs to URL filtering and DNS deny‑list policies, especially for any Google‑related authentication flows. Continuous monitoring of the associated IP address is advised, as the same address could be reused for further impersonation attempts. Organizations using Google services should enforce HTTPS‑only policies and implement multi‑factor authentication to mitigate credential‑theft risk from similar domains. Incident response teams should also review recent logs for any outbound connections to the domain or its IP to identify potential exposure while the site was active.