wlfi[.]airdrpsalert[.]club

The domain wlfi.airdrpsalert.club is a confirmed phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google service to deceive users into entering sensitive information, such as login credentials. No crypto drainer kit was detected. As of the latest verification, wlfi.airdrpsalert.club has been taken offline, but it remains a documented threat for historical reference.

Technical analysis reveals that wlfi.airdrpsalert.club was flagged by 2 of 95 security vendors on VirusTotal, including ChainPatrol and SOCRadar. It appears on 1 security blocklist, PhishDestroy, and was registered through Dynadot LLC on October 26, 2025. The domain resolved to the IP address 142.250.74.196, hosted on Google LLC infrastructure in the US (AS15169). No SSL certificate was issued, and the observed page title was 'Google'. Nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification.

Users who interacted with wlfi.airdrpsalert.club should immediately change any passwords entered on the site, particularly for Google accounts, and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the domain to Google’s phishing reporting tool and to platforms like PhishTank or the Anti-Phishing Working Group (APWG) to aid in broader threat mitigation. If financial or personal data was exposed, consider contacting relevant institutions to secure accounts.