bob[.]airdrpsalert[.]lol

PhishDestroy has identified bob.airdrpsalert.lol as an elevated risk domain engaged in brand impersonation, specifically targeting Gmail. This type of threat involves creating a fake login page that mimics the legitimate Google interface to steal user credentials. The domain was taken offline after being flagged, but its history suggests it was actively used for credential harvesting. Users who may have interacted with this site should be cautious and change their Gmail passwords immediately.

Technical analysis reveals several red flags. The domain was registered through Dynadot LLC on October 22, 2025, and its page title was set to "Google" to deceive visitors. It resolved to IP address 142.250.191.4, which is associated with Google's infrastructure, but no SSL certificate was found, indicating a lack of encryption. VirusTotal data shows that 4 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. These indicators strongly suggest this domain was designed to impersonate Google's login page and compromise user accounts.

To stay safe, users should never enter credentials on sites reached via unsolicited links or emails. Always verify the URL carefully before logging into Gmail or any other service. Enable two-factor authentication on your Google account to add an extra layer of security. If you suspect your credentials have been compromised, change your password immediately and review recent account activity. PhishDestroy recommends using a password manager to detect known phishing sites and report any suspicious domains to Google's Safe Browsing team.