freeairdrophub[.]pp[.]ua

The domain freeairdrophub.pp.ua was a phishing site engaged in brand impersonation, specifically targeting Google as part of a tech-support scam. It posed an elevated risk by mimicking legitimate services to deceive users into divulging credentials or installing malicious software. No crypto drainer kit was detected, and the site is currently taken offline.

Technical analysis of freeairdrophub.pp.ua revealed minimal detection, with only 1 of 95 VirusTotal security vendors (Gridinsoft) flagging it, alongside a Gridinsoft trust score of 0/100. The domain was registered through NIC.UA LLC (nic-mnt-cunic) and resolved to the IP address 172.217.18.19, hosted on Google LLC’s infrastructure (AS15169). It appeared on a single security blocklist (PhishDestroy) and used an SSL certificate issued by Google Trust Services / WR3. The observed page title was 'مركز الإيردروبات المجانية,' and the site employed technologies such as Blogger, Java, Python, and OpenGSE. Nameservers were ns10.uadns.com, ns11.uadns.com, and ns12.uadns.com.

Users who interacted with freeairdrophub.pp.ua should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on affected accounts, and monitor for unauthorized activity. Report the domain to Google Safe Browsing, local cybersecurity authorities, or platforms like PhishTank to aid in takedown efforts. If financial or crypto accounts were accessed, revoke token approvals and transfer funds to a new, secure wallet.