hub-airdrpsalert[.]sbs

Analysis indicates that the domain hub-airdrpsalert.sbs was registered on November 17 2025 via Dynadot LLC and is currently taken offline. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, suggesting the domain leveraged Cloudflare DNS services. DNS resolution points to IP address 142.251.140.164, which is announced by AS15169 Google LLC and located in the United States. The hosting IP belongs to Google’s infrastructure, which may be used to increase perceived legitimacy. No TLS certificate was observed for the site, indicating HTTP‑only access. The page title returned by the web server is “Google”, matching the declared brand target and confirming the brand‑impersonation payload.

Google Safe Browsing has labeled the domain as a social‑engineering threat, and a single security blocklist currently lists the domain. The Gridinsoft trust score is 0 out of 100, reflecting a highly malicious reputation. VirusTotal analysis shows that 8 of 95 scanned security vendors flagged the domain, reinforcing the malicious assessment. The domain was also blocked by the PhishDestroy feed. The available evidence points to a brand‑impersonation campaign aimed at Google users, likely relying on the familiar “Google” title and the legitimate‑looking IP range to lure victims.

Uncertainty remains regarding the specific payload delivered to victims, as no content beyond the title has been captured, and no SSL/TLS layer was available for deeper inspection. It is also unclear whether the domain was used in a large‑scale campaign or limited to targeted phishing attempts, as only one blocklist entry has been observed. Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any HTTP requests to the IP 142.251.140.164 that reference the hub‑airdrpsalert.sbs host, and update endpoint protection signatures to include the 8 VirusTotal detections.