hub-airdrops[.]sbs
“Google”
hub-airdrops.sbs — Belum terverifikasi. Peniruan identitas merek: Google; Jenis penipuan: Airdrop Scam. Ringkasan bukti: VirusTotal 16/95 (ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, CRDF); Spamhaus DBL_PHISH; 2 external blocklist matches (MetaMask, SEAL); PhishDestroy score 95/100. Registrar: Dynadot.
Analisis terperinci PhishDestroy AI di bawah tetap berbahasa Inggris untuk menjaga catatan forensik asli.
Analysis as of July 23, 2026 indicates that hub-airdrops.sbs is an active brand‑impersonation campaign targeting Google users with a fake airdrop lure. The domain was registered on 14 Nov 2025 through Dynadot LLC and resolves to 142.250.185.100, an address owned by Google LLC (ASN 15169) in the United States. DNS resolution is handled by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and the site serves a TLS certificate issued by Google Trust Services under the WE1 profile, further reinforcing the appearance of legitimacy. The HTTP response currently returns a 502 status, suggesting the backend service is unavailable or misconfigured, but the page title returned by the server is “Google”, matching the advertised brand target.
VirusTotal has recorded 16 positive detections out of 95 scanned security vendors, and the domain appears on three external blocklists. Independent blocklist services PhishDestroy, MetaMask, and SEAL have already listed the domain as malicious. The Gridinsoft trust score of 0 / 100 reflects an extremely low reputation. No additional content analysis is available beyond the page title; the exact landing page layout and payload have not been captured.
Given the convergence of a Google‑owned IP address, a Google‑issued TLS certificate, and the use of Cloudflare infrastructure, the infrastructure appears to be a credential‑harvesting front that leverages trusted assets to increase user trust. Defenders should block DNS resolution for hub‑airdrops.sbs at the network perimeter, add the IP address 142.250.185.100 to URL filtering rules that target suspicious Google‑related traffic, and ensure that web‑gateway safe‑browsing services incorporate the domain and its associated blocklist entries.
Alur Tanggapan Ancaman Pipeline
Status Daftar Blokir Publik
Tangkapan tersimpan
Intelijen Domain
Rincian teknisDNS, SAN SSL, cap waktu
ZONA SHORTDOT · BUKTI PUBLIK
.sbs
ShortDot zone evidence
ShortDot zone evidence
The linked repository preserves daily zone observations across seven ShortDot-operated TLDs, including registration volume and abuse-related indicators. This registry context is supporting background and is not an independent detection for the domain in this report.
ICANN OVERSIGHT
Akreditasi dan konteks RAA
Akreditasi dan konteks RAA
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Intelijen Forensik
Teknologi · 2 identified
Web infrastructure and security company providing CDN, DDoS mitigation, and DNS services.
www.cloudflare.comThird major version of HTTP protocol, built on QUIC for faster, more reliable connections.
Analisis VirusTotal
Bukti Terarsip
Bukti & Laporan Eksternal
Apakah Anda Terpengaruh oleh Situs Ini?
Jika Anda memasukkan kredensial akun, informasi pribadi atau pembayaran, atau mengunduh file dari domain ini, segera ambil tindakan. Di bawah ini adalah sumber daya untuk membantu Anda melaporkan insiden tersebut dan melindungi diri Anda sendiri.
Laporkan kepada Pihak Berwenang di Daerah Anda
Pilih negara Anda untuk mendapatkan kontak resmi kejahatan dunia maya, atau membuat draf pengaduan →.
Periksa Domain Apa Pun
Analisis ancaman menggunakan daftar blokir yang disimpan, WHOIS, DNS, dan bukti pemindaian publik
Pindai SekarangLaporkan Phishing
Laporkan domain yang mencurigakan ke basis data ancaman kami — lindungi komunitas
LaporanPemberitahuan Ancaman Real-Time
Laporan phishing terbaru dan perubahan ketersediaan yang diamati
PantauTetap Terinformasi, Tetap Aman
Pantau ancaman secara langsung atau ajukan keberatan terhadap daftar ini jika Anda yakin ini merupakan false positive