scr[.]airdrpsalert[.]sbs

This domain, scr.airdrpsalert.sbs, poses a credential theft threat by impersonating Google’s login infrastructure. Visitors are presented with a fraudulent page titled 'Google,' which closely resembles the legitimate Google sign-in portal. The site is engineered to capture usernames, passwords, and potentially multi-factor authentication codes, enabling unauthorized access to Google accounts and linked services. Such attacks often lead to further exploitation, including data exfiltration, financial fraud, or lateral movement within compromised environments. Analysis indicates this domain was registered on October 22, 2025, through Dynadot LLC, a registrar frequently leveraged for malicious infrastructure. It resolves to the IP address 172.217.23.100, which is associated with legitimate Google services, suggesting an attempt to blend in with authentic traffic or exploit misconfigured security controls. VirusTotal data reveals that 10 out of 95 security vendors have flagged this domain as malicious, while it also appears on one security blocklist. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. If you visited scr.airdrpsalert.sbs or entered credentials on this site, immediate action is required. First, change the password for your Google account and any other accounts using the same credentials. Enable multi-factor authentication if not already active, using an authenticator app or hardware key rather than SMS-based methods. Review recent account activity for unauthorized access or suspicious transactions. Monitor linked accounts, such as email, cloud storage, or financial services, for signs of compromise. If sensitive data was exposed, consider reporting the incident to relevant data protection authorities or cybersecurity response teams for further guidance.