send[.]airdrpsalerts[.]sbs

This domain, send.airdrpsalerts.sbs, is flagged for brand_impersonation targeting Google users through fraudulent account alerts. Analysis indicates the infrastructure was designed to mimic legitimate Google notifications, likely to harvest login credentials or distribute malicious payloads under the guise of urgent security warnings. The page title 'Google' and domain structure suggest an attempt to deceive users into believing the communication originated from official Google services, exploiting trust in the brand to bypass skepticism. Evidence supporting this assessment includes detection by 10 out of 95 security vendors on VirusTotal, a trust score of 0/100, and registration through Dynadot LLC on October 29, 2025. The domain resolves to the IP address 142.251.167.106, which is atypical for Google’s legitimate infrastructure. Additionally, the domain appears on one security blocklist and has been taken offline, though its prior activity remains a concern. The creation date, less than a month prior to discovery, aligns with common phishing campaign timelines where domains are rapidly deployed and discarded. Users who visited send.airdrpsalerts.sbs should immediately revoke any credentials entered on the site and enable multi-factor authentication on their Google accounts. Monitor account activity for unauthorized access or changes, and consider resetting passwords for other services if password reuse is suspected. Organizations should update blocklists to include this domain and its associated IP address, while end-users should verify the legitimacy of any unexpected alerts by accessing services directly through official channels rather than clicking embedded links.