bob[.]airdrpalert[.]click

This domain, bob.airdrpalert.click, presents an elevated risk as a brand impersonation threat specifically targeting Gmail users. The site was designed to mimic the Google login page, as indicated by its page title "Google," in an attempt to steal credentials. Although the domain is currently offline, its history and indicators suggest a high potential for harm if it becomes active again.

Technical analysis reveals several red flags. VirusTotal shows 3 out of 95 security vendors flagging this domain as malicious, and it appears on at least one security blocklist. The domain was registered on October 30, 2025, through Dynadot LLC, and resolves to IP address 142.250.186.164. Notably, the site does not have an SSL certificate, which is unusual for any legitimate Google-related service. These factors collectively indicate a sophisticated impersonation attempt.

To protect against such threats, users should always verify URLs before entering credentials, especially for Google services. Enable two-factor authentication on Gmail accounts and use a password manager that auto-fills only on legitimate domains. If you suspect you have interacted with this site, change your password immediately and review account activity for unauthorized access. Check the full report for more details and indicators of compromise.