arb[.]airdropsalert[.]us

The domain arb.airdropsalert.us is a high-risk phishing site engaged in brand impersonation, specifically targeting Google as part of a cryptocurrency scam. This site was designed to deceive users into believing they were interacting with a legitimate Google service, likely to harvest credentials or promote fraudulent crypto activities. As of the latest verification, arb.airdropsalert.us has been taken offline, but it remains a documented threat due to its recent malicious activity.

Technical indicators confirm the domain's malicious nature. arb.airdropsalert.us was flagged by 12 of 95 security vendors on VirusTotal, including ChainPatrol, alphaMountain.ai, and BitDefender. Google Safe Browsing classified it as 'SOCIAL_ENGINEERING' under its phishing flags, and it appeared on one security blocklist (PhishDestroy). The domain was registered through Dynadot LLC on October 18, 2025, and resolved to the IP address 172.253.62.103, hosted on Google LLC's infrastructure (AS15169). No SSL certificate was present, and the observed page title was 'Google'. Nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and Gridinsoft assigned it a trust score of 0/100.

Users who interacted with arb.airdropsalert.us should take immediate safety steps. If cryptocurrency transactions or token approvals were involved, revoke all active approvals and transfer funds to a new wallet. For credential phishing, change passwords for any accounts accessed or entered on the site, enable two-factor authentication, and monitor accounts for unauthorized activity. Report the domain to Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in broader threat mitigation.