airdropalert[.]group

This domain, airdropalert.group, poses a direct threat as a brand impersonation phishing site targeting Gmail users. Analysis indicates the site mimics the Google login interface, presenting a page titled 'Google' to deceive visitors into entering credentials. The domain is designed to harvest login details, enabling unauthorized access to email accounts, which may lead to further compromise of linked services or identity theft. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain is registered through Cloudflare, Inc., and resolves to the IP address 142.250.186.100, located in Germany under AS15169 (Google LLC). Despite the IP association with Google, the domain is flagged by 12 out of 95 security vendors on VirusTotal, including a phishing designation from Google Safe Browsing. It appears on one security blocklist and is actively blocked by enterprise threat intelligence feeds. The SSL certificate, issued by Google Trust Services (WE1), further complicates detection by appearing legitimate at first glance. Users who have visited airdropalert.group should immediately change their Gmail passwords and enable multi-factor authentication if not already active. Any credentials entered on this site should be considered compromised. It is recommended to review account activity for unauthorized logins or sent messages and revoke access for any unfamiliar third-party applications linked to the account. System scans for malware are advised, as phishing sites may also distribute malicious payloads. Organizations should update their blocklists to include this domain and monitor for related indicators of compromise.