dot[.]airdrpsalert[.]click

The domain dot.airdrpsalert.click is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as an official Google page to deceive users into disclosing login credentials or other sensitive information. No crypto drainer kit was detected. The site is currently taken offline, but its prior activity poses an elevated risk to users who may have interacted with it.

Technical analysis of dot.airdrpsalert.click reveals limited detection by security vendors, with 2 of 95 VirusTotal vendors flagging it, including ChainPatrol and SOCRadar. The domain was registered through Dynadot LLC on October 26, 2025, and resolves to the IP address 142.251.140.164, hosted on Google LLC's infrastructure in the US. It appears on one security blocklist, PhishDestroy, and has a Gridinsoft trust score of 0/100. The site lacks an SSL certificate, and its observed page title was 'Google'. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

Users who visited dot.airdrpsalert.click should immediately change any passwords entered on the site, particularly for Google accounts, and enable two-factor authentication (2FA) if not already active. Monitor accounts for unauthorized activity and report any suspected fraud to the impersonated brand’s support team. To report the phishing domain, submit it to Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG). If financial or crypto accounts were accessed, contact the respective service providers to secure accounts and review transaction histories.