airdrpsalerts[.]sbs

Analysis of airdrpsalerts.sbs indicates a high-risk brand impersonation domain targeting Google users. The domain was registered on October 29, 2025, through Dynadot LLC and uses Cloudflare nameservers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com). It resolves to IP 216.58.212.132, which belongs to AS15169 (Google LLC) in the US, though this IP association does not confirm legitimacy. No SSL certificate was detected, increasing the likelihood of unencrypted malicious activity. The page title was recorded as 'Google,' directly matching the impersonated brand.

The domain appears on four security blocklists and is actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. AlienVault OTX includes the domain in two threat intelligence pulses, suggesting prior malicious campaigns. While 15 of 95 security vendors on VirusTotal flagged the domain as malicious, the absence of a full scan means this detection rate may not reflect all potential threats. Current infrastructure shows the domain is offline, but defenders should treat it as compromised until further analysis confirms remediation.

The combination of brand impersonation, blocklist presence, and zero trust score justifies immediate blocking at the network and endpoint levels. No evidence confirms the exact scam mechanics (e.g., credential harvesting, malware distribution), but the domain’s design aligns with phishing campaigns targeting Google services. Review logs for connections to 216.58.212.132 or DNS queries for airdrpsalerts.sbs between October 2025 and July 2026. If found, investigate for unauthorized account access or data exfiltration.