hydration[.]airsdropsalerts[.]sbs

This domain, hydration.airsdropsalerts.sbs, was created on 07 November 2025 and is currently taken offline. It resolves to the IP address 172.217.18.4, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain is registered through Dynadot LLC and uses Cloudflare authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No SSL certificate is presented for the host, and Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of reputation.

The page title returned from the site is “Google”, matching the declared brand target of Google and confirming the classification as a brand‑impersonation campaign. VirusTotal has recorded 12 detections out of 95 scanning engines, and the domain appears on a single public blocklist. PhishDestroy has also flagged the domain as malicious. Because the site is offline, the exact payload and user‑experience cannot be observed, leaving the specifics of the phishing lure uncertain.

Nonetheless, the combination of a brand‑matching title, low trust score, multiple vendor detections, and blocklist listings provides strong evidence of a malicious impersonation attempt. Defenders should immediately block traffic to both the domain and its resolved IP address, add the domain to internal URL filtering and DNS sinkhole rules, and monitor for any new domains that resolve to the same IP range or use similar naming patterns. Continuous review of threat‑intel feeds for additional indicators related to the 12 VirusTotal detections and the single blocklist entry is advised, as is verifying that any legitimate Google services hosted on the same IP are not inadvertently impacted.