arb[.]airdrpsalert[.]click

The domain arb.airdrpsalert.click is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google service but is designed to deceive users into disclosing sensitive information. No crypto drainer kit was identified. The site is currently taken offline, reducing immediate risk, but prior visitors should remain cautious of potential credential theft or fraud.

Technical indicators confirm arb.airdrpsalert.click as malicious. As of analysis, 2 of 95 VirusTotal security vendors flagged the domain, including ChainPatrol and SOCRadar. It appears on 1 security blocklist (PhishDestroy) but is not flagged by Google Safe Browsing. The domain was registered on 2025-10-26 03:26:37 via Dynadot LLC and resolves to the IP address 142.250.185.164, hosted on Google LLC infrastructure (AS15169). No SSL certificate was issued, and the observed page title was 'Google'. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

Users who interacted with arb.airdrpsalert.click should take immediate safety steps. If login credentials were entered, change passwords for the affected account and any reused credentials, then enable two-factor authentication (2FA). Monitor accounts for unauthorized activity and report suspected fraud to the impersonated brand (Google). Victims may also report the domain to their local cybercrime unit or platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.