scr[.]airdrpsalert[.]club

This domain, scr.airdrpsalert.club, poses a brand impersonation threat targeting Google users. The site mimics legitimate Google login or alert pages, likely designed to harvest credentials, personal data, or distribute malware under the guise of official communication. Visitors may encounter fake security warnings, account verification prompts, or urgent alerts urging immediate action, all of which are crafted to exploit trust in the Google brand. The risk is elevated due to the domain's convincing presentation and historical use in credential theft campaigns. Analysis indicates the domain was flagged by 10 out of 95 security vendors on VirusTotal, suggesting moderate but consistent detection. It was registered on October 26, 2025, through Dynadot LLC, a registrar frequently associated with newly created malicious domains. Infrastructure analysis reveals the domain resolved to IP address 216.58.206.68 and appeared on one security blocklist prior to being taken offline. The page title was explicitly set to 'Google,' reinforcing its intent to deceive users into believing they were interacting with a legitimate service. If a user visited scr.airdrpsalert.club, immediate action is required to mitigate potential compromise. First, terminate any active sessions on the site and avoid entering credentials or personal information. Next, change passwords for Google accounts and any other services where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins, sent emails, or financial transactions. If malware was downloaded, disconnect the device from the network and perform a full system scan using updated security tools. Report the incident to internal security teams or relevant authorities to aid in tracking and mitigating the threat.