cetus[.]airdrpsalert[.]click

The domain cetus.airdrpsalert.click is a phishing site engaged in brand impersonation targeting Google. It presents itself as the legitimate Google login page to deceive users into entering credentials, posing an elevated risk of account compromise. No crypto drainer kit was detected. As of the latest verification, cetus.airdrpsalert.click has been taken offline.

Technical indicators show cetus.airdrpsalert.click was flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and SOCRadar. It appears on 1 security blocklist (PhishDestroy) but is not flagged by Google Safe Browsing. The domain was registered through Dynadot LLC on October 26, 2025, and resolves to the IP address 142.250.186.132, hosted on Google LLC infrastructure in the US. No SSL certificate is present, and the observed page title is 'Google'. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Gridinsoft assigns a trust score of 0/100 to cetus.airdrpsalert.click.

Users who interacted with cetus.airdrpsalert.click should immediately change their Google account password and enable two-factor authentication (2FA) if not already active. Monitor the account for unauthorized activity, such as unfamiliar logins or changes to settings. Report the phishing domain to Google via their phishing reporting page and to the registrar, Dynadot LLC, for further action. Additionally, victims may submit the domain to platforms like PhishTank or the Anti-Phishing Working Group to aid in broader takedown efforts.