eth[.]airdrpsalert[.]sbs

The domain eth.airdrpsalert.sbs is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google service to deceive users into disclosing sensitive information, such as login credentials. No crypto drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk, but prior exposure may still pose a threat to users who interacted with it.

Technical analysis reveals that eth.airdrpsalert.sbs was flagged by 3 of 95 security vendors on VirusTotal, including ChainPatrol, SOCRadar, and Webroot. It appears on 1 security blocklist, PhishDestroy, and was registered through Dynadot LLC on October 22, 2025. The domain resolves to the IP address 142.251.40.132, hosted on Google LLC's infrastructure (AS15169) in the US. No SSL certificate was observed, and the page title displayed was 'Google'. Nameservers are hosted on Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com). Google Safe Browsing did not flag the domain at the time of assessment.

Users who may have interacted with eth.airdrpsalert.sbs should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) on all critical services to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google's Safe Browsing team via their reporting tool and to the registrar, Dynadot LLC, to aid in takedown efforts. If financial or crypto-related credentials were exposed, contact relevant institutions to secure accounts and review transaction histories for fraud.