flx[.]airdrpsalert[.]sbs

The domain flx.airdrpsalert.sbs is identified as a brand impersonation phishing site targeting Gmail. This domain poses a significant risk by misleading users into believing they are interacting with a legitimate Google service, which can lead to the theft of sensitive information such as login credentials and personal data.

Analysis indicates that 9 out of 95 security vendors on VirusTotal flagged this domain as malicious. The domain was registered through Dynadot LLC and was created on October 22, 2025. It currently does not have an SSL certificate, which is a common indicator of a non-secure site. The domain was taken offline as of the last status update, and it is known to resolve to the IP address 172.253.62.99, located in the United States and associated with the AS15169 network, which is operated by Google LLC. The domain also appears on one security blocklist, further confirming its malicious nature.

Users who visited this domain are advised to immediately change their Gmail passwords and enable two-factor authentication (2FA) to protect their accounts. It is recommended to monitor account activity for any unauthorized access and to report the incident to Google's security team. Additionally, users should remain vigilant and avoid clicking on suspicious links or providing personal information to unverified websites.