wlfi[.]airdropsalert[.]biz

This domain, wlfi.airdropsalert.biz, operates as a deceptive Gmail login portal designed to harvest user credentials. The site mimics Google’s branding, presenting a page titled 'Google' to trick visitors into entering their email and password. Such impersonation attacks are commonly used to gain unauthorized access to accounts, enabling further malicious activities like data theft, financial fraud, or lateral movement within compromised networks. Analysis indicates the domain was registered on October 18, 2025, through Dynadot LLC, a registrar frequently used for short-lived phishing campaigns. It lacks an SSL certificate, a red flag for fraudulent sites, and resolves to an IP address (142.250.185.196) hosted by Google LLC, likely leveraging legitimate infrastructure to evade detection. The domain appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal, confirming its malicious intent. Its current offline status suggests takedown efforts, but similar domains may reemerge. If you visited wlfi.airdropsalert.biz and entered credentials, take immediate action. Reset your Gmail password using a secure device and enable multi-factor authentication if not already active. Review your account for unauthorized activity, including logins from unfamiliar locations or devices. Check connected apps and revoke access for any suspicious third-party services. Monitor linked accounts (e.g., financial or social media) for signs of compromise, as attackers may use stolen credentials to pivot to other platforms. Consider reporting the incident to your organization’s security team if the account is work-related.