airdropalerts[.]help

This domain, airdropalerts.help, is a confirmed credential harvesting operation targeting Gmail users through brand impersonation. The site presents itself as an official Google service, using the page title 'Google' to deceive visitors into entering sensitive login credentials. Infrastructure analysis reveals the domain was designed to mimic legitimate authentication portals, with visual and functional elements closely resembling Gmail's interface to maximize phishing success rates. The primary threat posed by this domain is the unauthorized collection of Google account credentials, which can lead to account takeovers, unauthorized access to sensitive data, and subsequent exploitation for further malicious activities such as spam campaigns, financial fraud, or identity theft. Evidence supporting this assessment includes multiple technical indicators. The domain was registered on November 27, 2025, through Dynadot LLC, with a suspiciously recent creation date that aligns with common phishing campaign timelines. It resolves to the IP address 142.250.186.164, which is associated with Google LLC's infrastructure (AS15169), potentially used to lend false credibility. Security vendor analysis on VirusTotal shows 17 out of 95 engines flagging the domain as malicious, indicating a significant detection rate. The domain appears on one security blocklist and is explicitly flagged by Google Safe Browsing as a phishing site. Additionally, the SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is often exploited by threat actors to create a false sense of security. Users who visited airdropalerts.help should immediately take corrective actions to mitigate potential compromise. First, change the password for any Google account accessed through this domain, using a strong, unique password not reused elsewhere. Enable multi-factor authentication on all accounts to add an additional security layer. Monitor account activity for any unauthorized access or suspicious transactions, including reviewing recent login locations and connected devices. If financial or sensitive information was entered, consider placing a fraud alert on credit files and monitoring for signs of identity theft. Organizations should update their security blocklists to include this domain and its associated IP address to prevent future access attempts. Users should also scan their devices for malware, as credential harvesting sites often deploy additional payloads to maintain persistence or exfiltrate further data.