op[.]airdrpsalert[.]click

PhishDestroy assesses op.airdrpsalert.click as elevated risk due to its brand impersonation threat type, specifically mimicking Google's Gmail login page to steal credentials. The domain was created on October 26, 2025, and resolved to IP 172.253.62.105, but is now offline. It was registered through Dynadot LLC and its page title was simply "Google," a classic lure for unsuspecting users.

VirusTotal data shows 2 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. The domain lacked an SSL certificate, meaning any data submitted would have been transmitted in plain text. Despite the low blocklist count, the targeted brand—Gmail—and the precise impersonation increase the risk significantly, as Gmail accounts often contain sensitive personal or business information.

Users who may have visited this site should immediately change their Gmail password and enable two-factor authentication. If credentials were entered, they should also revoke third-party app access and monitor for unusual account activity. PhishDestroy recommends always verifying URLs before signing in, especially when redirected from unsolicited messages, and enabling phishing protection in email clients.