usual[.]airdrpsalert[.]click

The domain usual.airdrpsalert.click is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page to deceive users into disclosing credentials or other sensitive information. No crypto drainer kit was detected. As of the latest verification, usual.airdrpsalert.click has been taken offline, but it remains a documented threat for historical reference and potential re-emergence.

Technical indicators confirm the domain's malicious intent. usual.airdrpsalert.click was flagged by 2 of 95 security vendors on VirusTotal, including ChainPatrol and SOCRadar, while appearing on 1 security blocklist (PhishDestroy). The domain was registered through Dynadot LLC on October 26, 2025, and resolved to the IP address 142.250.181.228, hosted on Google LLC's infrastructure (AS15169) in the US. No SSL certificate was issued, and the observed page title was 'Google'. Nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Google Safe Browsing did not flag the domain at the time of assessment.

Users who may have interacted with usual.airdrpsalert.click should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) on all critical services to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google's Safe Browsing team via their reporting tool and to the registrar, Dynadot LLC, to support takedown efforts. If financial or personal data was exposed, consider contacting relevant institutions to flag potential fraud.