threshold[.]airdrpsalerts[.]xyz

This domain, threshold.airdrpsalerts.xyz, carries an elevated risk level due to its impersonation of Gmail, a brand impersonation threat that could be used to harvest user credentials. The domain was registered on November 4, 2025, through Dynadot LLC, and resolves to the IP address 142.250.186.36, which interestingly appears to be a legitimate Google IP, but the domain itself is malicious. VirusTotal analysis shows 11 out of 95 security vendors flagging this domain as malicious, and it appears on one security blocklist. Notably, the domain has no SSL certificate, which is atypical for a legitimate Gmail login page, and its status is currently offline, possibly due to takedown efforts.

To protect against this threat, users should never enter their credentials on any page accessed via this domain. Always verify the URL in the browser's address bar, ensuring it starts with https://mail.google.com. Enable two-factor authentication on your Google account as an additional security layer. If you suspect you have interacted with this domain, change your password immediately and monitor your account for suspicious activity. Report any such domains to PhishDestroy for further analysis and blocklisting.