arb[.]airdropsalert[.]live

This domain, arb.airdropsalert.live, is flagged as a high-risk brand impersonation threat specifically targeting Gmail users. Analysis indicates the site mimics legitimate Google authentication pages, as evidenced by its page title 'Google' and confirmed phishing classification by Google Safe Browsing. The threat leverages deceptive infrastructure to harvest credentials, posing significant risk to end-users and organizational security. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., a registrar frequently abused for anonymity in malicious campaigns. The domain resolves to the IP address 142.250.80.68, which is geolocated in the United States under AS15169 (Google LLC). Despite resolving to a Google-owned IP, the domain lacks an SSL certificate, a red flag for phishing activity. Detection metrics further confirm its malicious nature, with 15 out of 95 security vendors on VirusTotal flagging the domain as phishing. Additionally, it appears on one security blocklist and is actively blocked by PhishDestroy, reinforcing its classification as a confirmed threat. Mitigation measures should prioritize immediate blocking of the domain and its associated IP across all network security controls. Organizations are advised to deploy email filtering rules to quarantine messages containing links to arb.airdropsalert.live, particularly those impersonating Gmail login prompts. End-user education should emphasize verifying domain authenticity before entering credentials, especially for pages mimicking Google’s branding. Security teams should monitor for credential reuse attempts stemming from this campaign and enforce multi-factor authentication to mitigate account compromise risks. Given the domain’s active status, continuous monitoring for related infrastructure or similar impersonation attempts is recommended.