w[.]airdropsalert[.]app

The domain w.airdropsalert.app has been confirmed as a phishing site engaging in brand impersonation, specifically targeting Gmail users. Analysis indicates the site is designed to mimic Google’s login interface, as evidenced by the page title "Google" and the absence of legitimate authentication mechanisms. The domain is currently offline, but prior activity aligns with credential harvesting tactics commonly used to compromise email accounts. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolves to the IPv6 address 2607:f8b0:4004:c19::6a, hosted on an autonomous system (AS15169) associated with Google LLC in the United States. Despite the hosting provider’s reputation, the domain lacks an SSL certificate, a critical security indicator for user trust. Security vendors have flagged the domain as malicious, with 17 of 95 engines on VirusTotal detecting it as a threat. Additionally, the domain appears on one security blocklist, further corroborating its malicious nature. No historical trust scores or benign classifications were identified during analysis. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the risk of reemergence remains elevated given the domain’s prior use in phishing campaigns. Organizations and users are advised to block the domain at the network level and monitor for similar impersonation attempts targeting Gmail or other email providers. Security teams should review logs for connections to the IPv6 address 2607:f8b0:4004:c19::6a and investigate potential credential exposure. End users should be educated on recognizing brand impersonation tactics, particularly those involving fake login pages or unsolicited authentication requests.