w[.]airdropsalert[.]us

This domain, w.airdropsalert.us, was identified as a credential harvesting site specifically targeting Gmail users through brand impersonation. The site presented a fraudulent login interface mimicking Google’s authentication portal, designed to deceive users into submitting their email credentials. Analysis of the page title, which displayed 'Google,' confirms the intent to replicate the legitimate Gmail login experience, increasing the likelihood of successful phishing attempts against unsuspecting users. Infrastructure analysis reveals multiple technical indicators supporting the classification of this domain as malicious. The domain was registered on October 18, 2025, through Dynadot LLC, a registrar frequently associated with abusive registrations. It resolved to the IP address 192.178.155.147, geolocated within the United States under AS15169 (Google LLC), though this IP does not align with Google’s legitimate infrastructure. Security vendor detections on VirusTotal reached 13 out of 95, with one confirmed blocklist entry by PhishDestroy. Notably, the domain lacked an SSL certificate, a deviation from standard security practices for legitimate login portals. Users who accessed w.airdropsalert.us are advised to take immediate remedial action to mitigate potential compromise. Any credentials entered on this site should be considered exposed and must be changed without delay, starting with the associated Gmail account and extending to any other platforms where identical passwords were reused. System scans using updated security tools are recommended to detect potential secondary infections. Additionally, affected users should monitor their accounts for unauthorized activity and enable multi-factor authentication to prevent further unauthorized access. Organizations should update their email security filters to block this domain and its associated IP address to prevent future exposure.