threshold[.]airdrpsalert[.]sbs

This domain, threshold.airdrpsalert.sbs, is flagged as a brand impersonation threat targeting Google. Analysis indicates the site hosted a fraudulent login portal designed to harvest user credentials by replicating Google’s authentication interface. No drainer kit signatures were identified, but the domain’s infrastructure aligns with credential phishing campaigns observed in recent months. Infrastructure analysis reveals the domain was registered through Dynadot LLC on October 22, 2025, and resolves to the IP address 216.58.206.36. VirusTotal detection shows 10 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, and its Gridinsoft trust score is 0/100. Google Safe Browsing (GSB) status was not explicitly listed, but the domain’s rapid takedown suggests prior detection. As of the latest verification, threshold.airdrpsalert.sbs is offline, likely due to enforcement actions by hosting providers or registrars. However, residual risk remains for users who may have interacted with the domain before its deactivation. Organizations are advised to monitor for credential reuse attempts and update blocklists to include this domain and its associated IP. Proactive log reviews for authentication attempts tied to this domain are recommended to identify potential compromised accounts.