abstract[.]airdrpsalert[.]lol

The domain abstract.airdrpsalert.lol is a phishing site engaged in brand impersonation targeting Google. It presents itself as a legitimate Google page to deceive users into entering credentials or sensitive information, posing an elevated risk of credential theft. No crypto drainer kit was identified. The site is currently taken offline, but prior activity indicates it was actively used for phishing scams.

Technical indicators confirm the malicious nature of abstract.airdrpsalert.lol. The domain was flagged by 3 of 95 VirusTotal security vendors, including ChainPatrol, G-Data, and SOCRadar. It appears on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. Registered through Dynadot LLC on October 22, 2025, the domain resolves to the IP address 142.250.181.228, hosted under AS15169 (Google LLC) in the US. No SSL certificate was issued, and the observed page title was 'Google'. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Gridinsoft assigned a trust score of 0/100.

Users who interacted with abstract.airdrpsalert.lol should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) on all accounts to mitigate further risk. Monitor financial and account activity for unauthorized transactions or logins. Report the domain to Google’s phishing reporting tool, the Federal Trade Commission (FTC) at reportfraud.ftc.gov, and local cybercrime authorities. If credentials were reused across other platforms, update those passwords as well to prevent credential-stuffing attacks.