airdropalert[.]us

PhishDestroy identifies airdropalert.us as a high-risk brand impersonation domain specifically targeting Gmail users. This domain was created on October 19, 2025, and registered through Dynadot LLC, a registrar often associated with malicious registrations. The page title displayed "Google" in an attempt to deceive visitors into believing they were accessing a legitimate Google service. The domain resolved to IP address 172.253.115.147, which is not associated with Google's official infrastructure, and lacked any SSL certificate, further indicating its fraudulent nature.

Technical analysis reveals that airdropalert.us appears on six security blocklists and is flagged by Google Safe Browsing as a phishing site. VirusTotal reports that 18 out of 95 security vendors classify this domain as malicious, while AlienVault OTX detected it in four threat intelligence pulses, underscoring its widespread recognition as a threat. The domain is currently offline, which suggests it may have been taken down by hosting providers or registrars after being reported. These indicators collectively confirm that airdropalert.us was designed to harvest credentials through brand impersonation of Gmail.

To protect against such threats, users should never enter Gmail credentials on unfamiliar domains, especially those with suspicious URLs or missing SSL certificates. Enable two-factor authentication on all Google accounts and use a password manager to avoid reusing passwords. If you have already interacted with this domain, change your Gmail password immediately and review account activity for unauthorized access. Report any similar domains to Google Safe Browsing and local cybersecurity authorities to help dismantle credential theft operations.