magma[.]airdropsalert[.]biz

This domain, magma.airdropsalert.biz, poses a high-risk credential theft threat by impersonating Gmail's login interface. Analysis indicates the site was designed to deceive users into entering their Google account credentials, which would then be captured by threat actors for unauthorized access or further malicious activity. The fraudulent page displays a convincing replica of the Gmail login portal, increasing the likelihood of successful compromise for unsuspecting visitors. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on October 18, 2025, through Dynadot LLC, and currently resolves to the IP address 142.250.186.36, hosted on AS15169 (Google LLC infrastructure). Despite its apparent association with Google's network, the domain lacks an SSL certificate and has been flagged by 14 out of 95 security vendors on VirusTotal. Additionally, it appears on one security blocklist and is marked as phishing by Google Safe Browsing, further validating its malicious classification. Users who visited magma.airdropsalert.biz or entered credentials on the site should immediately take corrective action. First, change the password for the affected Gmail account and any other accounts using the same credentials. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor the account for suspicious activity, such as unfamiliar sent emails, login attempts from unknown locations, or unauthorized changes to settings. If financial or sensitive data was accessed, consider reporting the incident to relevant authorities and credit monitoring services. Finally, scan the device used to access the site for malware, as credential theft sites may deploy additional payloads.