usual[.]airdrpsalerts[.]info

This domain, usual.airdrpsalerts.info, is identified as a brand impersonation phishing site targeting Gmail users. Analysis indicates the threat type is credential harvesting through spoofed Google login interfaces, as evidenced by the page title 'Google' and the domain's association with Gmail impersonation. The campaign appears designed to deceive users into entering sensitive account information on fraudulent pages, which are then exfiltrated to attacker-controlled infrastructure. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 12 out of 95 security vendors on VirusTotal, with detection labels primarily categorizing it as phishing or malicious. The domain resolves to the IP address 64.233.180.103, which is geolocated to the United States under AS15169 (Google LLC). Registration details indicate the domain was provisioned through Cloudflare, Inc., a common registrar for both legitimate and malicious domains. The site appears on one security blocklist and lacks an SSL certificate, a red flag for user security. No Google Safe Browsing (GSB) detection is explicitly noted, though the domain's offline status may affect current visibility in such databases. As of the latest assessment, usual.airdrpsalerts.info has been taken offline, likely due to remediation efforts by hosting providers or domain registrars. However, the elevated risk persists due to the domain's prior activity and the potential for re-emergence under similar infrastructure or naming conventions. Users who may have interacted with this domain are advised to rotate credentials immediately, particularly for Gmail and associated accounts. Organizations should monitor for indicators of compromise, including the IP address 64.233.180.103 and the domain registrar Cloudflare, Inc., in network logs. Proactive measures, such as deploying email filtering rules and educating users on recognizing phishing attempts, remain critical to mitigating similar threats.