hub-airdrops[.]sbs

Analysis as of July 23, 2026 indicates that hub-airdrops.sbs is an active brand‑impersonation campaign targeting Google users with a fake airdrop lure. The domain was registered on 14 Nov 2025 through Dynadot LLC and resolves to 142.250.185.100, an address owned by Google LLC (ASN 15169) in the United States. DNS resolution is handled by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and the site serves a TLS certificate issued by Google Trust Services under the WE1 profile, further reinforcing the appearance of legitimacy. The HTTP response currently returns a 502 status, suggesting the backend service is unavailable or misconfigured, but the page title returned by the server is “Google”, matching the advertised brand target.

VirusTotal has recorded 16 positive detections out of 95 scanned security vendors, and the domain appears on three external blocklists. Independent blocklist services PhishDestroy, MetaMask, and SEAL have already listed the domain as malicious. The Gridinsoft trust score of 0 / 100 reflects an extremely low reputation. No additional content analysis is available beyond the page title; the exact landing page layout and payload have not been captured.

Given the convergence of a Google‑owned IP address, a Google‑issued TLS certificate, and the use of Cloudflare infrastructure, the infrastructure appears to be a credential‑harvesting front that leverages trusted assets to increase user trust. Defenders should block DNS resolution for hub‑airdrops.sbs at the network perimeter, add the IP address 142.250.185.100 to URL filtering rules that target suspicious Google‑related traffic, and ensure that web‑gateway safe‑browsing services incorporate the domain and its associated blocklist entries.