cetus[.]airdrpsalert[.]sbs

PhishDestroy has identified cetus.airdrpsalert.sbs as a brand impersonation threat specifically targeting Gmail users. This domain was created on October 22, 2025, and registered through Dynadot LLC, with no SSL certificate present. It is currently offline, but its activity prior to takedown posed significant risk to users who may have encountered a fake Google login page. The domain resolves to IP address 142.250.181.228 and displayed a page titled "Google," which is a clear indicator of an attempt to harvest credentials by mimicking the legitimate Gmail login interface.

Technical analysis reveals that cetus.airdrpsalert.sbs appears on one security blocklist and has been flagged by 5 out of 95 VirusTotal vendors as malicious, reflecting a moderate detection rate but sufficient evidence of its fraudulent nature. The domain's creation date so close to its detection suggests it was rapidly deployed for a targeted phishing campaign. The absence of an SSL certificate further undermines any pretense of legitimacy, as legitimate Google services always use HTTPS. The combination of brand impersonation, recent registration, and blocklist presence elevates the risk level to high, despite the domain being offline at the time of this report.

Users are strongly advised never to enter credentials or personal information on any site that mimics Gmail or Google login pages, especially if the URL appears suspicious or unfamiliar. Even though cetus.airdrpsalert.sbs is now offline, similar domains may surface under new names. PhishDestroy recommends enabling two-factor authentication on all accounts and using a password manager to detect phishing URLs. If you have already interacted with this domain, change your Google account password immediately and review recent account activity for unauthorized access.