klima[.]airdropsalert[.]app

This domain, klima.airdropsalert.app, is identified as a high-risk brand impersonation threat targeting Gmail users. Analysis indicates the page title is explicitly set to 'Google,' suggesting an attempt to deceive users into believing they are accessing legitimate Gmail login credentials. The domain does not appear to deploy a cryptocurrency drainer kit but instead focuses on harvesting login credentials through a fake authentication interface. No associated wallet addresses or smart contract interactions were observed in preliminary analysis, reinforcing its classification as a credential phishing operation. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., a registrar frequently leveraged by threat actors to obscure ownership and evade takedowns. It resolves to the IP address 142.250.185.228, geolocated within the United States under Google LLC's autonomous system (AS15169). Despite the IP's association with a legitimate provider, the domain lacks an SSL certificate, a critical red flag for user security. Detection metrics show 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly categorizes it as phishing. The domain appears on one security blocklist, and additional protections have been implemented by at least one specialized threat intelligence feed. As of the latest assessment, klima.airdropsalert.app has been taken offline, likely due to automated or manual takedown procedures. However, the residual risk remains elevated due to the domain's prior use in credential harvesting campaigns. Users who may have interacted with the site are advised to rotate their Gmail passwords immediately and enable multi-factor authentication. Organizations should monitor for unauthorized access attempts linked to credentials potentially exposed via this domain. The infrastructure patterns observed—Cloudflare registration, lack of SSL, and rapid takedown—align with common phishing campaign tactics, suggesting the operators may redeploy similar domains in future attacks.