spaceandtime[.]airdropsalert[.]app

This domain, spaceandtime.airdropsalert.app, is flagged as a credential-harvesting phishing site specifically targeting Gmail users. Analysis indicates the site impersonates the Gmail login interface, as evidenced by the page title 'Google' and the domain’s registration under Cloudflare, Inc. The threat type is classified as brand impersonation, with Gmail as the primary target, suggesting an intent to capture user credentials through deceptive login prompts. Infrastructure analysis reveals the domain resolved to the IP address 216.58.206.68, geolocated in Germany under AS15169 (Google LLC). Despite the association with a legitimate autonomous system, the domain lacks an SSL certificate, increasing susceptibility to interception. Detection metrics show 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. The registrar, Cloudflare, Inc., is commonly used for both legitimate and malicious domains, complicating attribution. No creation date is provided, but the domain’s current offline status suggests takedown efforts may have been initiated. The domain has been taken offline, likely in response to security vendor interventions or registrar enforcement actions. However, the elevated risk level persists due to the potential for re-registration or migration to alternative infrastructure. Users who interacted with the domain are advised to rotate credentials immediately, particularly for Gmail accounts, and monitor for unauthorized access. Organizations should update blocklists to include this domain and its associated IP to prevent future exposure. Continuous monitoring of similar domains registered under Cloudflare is recommended to mitigate recurring threats.