airdropalerts[.]lol

This domain, airdropalerts.lol, operates as a fraudulent Google airdrop phishing site designed to deceive users into disclosing sensitive credentials or installing malicious payloads under the guise of official Google promotions. The page title explicitly mimics Google’s branding, and the domain was structured to exploit trust in Google’s services, likely targeting users searching for legitimate airdrop or reward programs. Given the absence of an SSL certificate and the use of a Google LLC-hosted IP (2607:f8b0:4004:c07::67), the infrastructure appears intentionally misleading, leveraging Google’s network to lend false legitimacy to the operation.

Analysis of the domain reveals multiple high-confidence indicators of malicious activity. The domain was registered on November 27, 2025, through Dynadot LLC, a registrar frequently associated with phishing campaigns. It is flagged by 17 out of 95 security vendors on VirusTotal and appears on five independent security blocklists, including PhishDestroy and ScamSniffer. Google Safe Browsing has also classified the domain as phishing. The domain resolved to a Google LLC-owned IP address (AS15169), which, while not inherently malicious, was likely exploited to evade initial reputation-based filters. No SSL certificate was present, further reducing the domain’s apparent legitimacy.

Users who visited airdropalerts.lol should assume potential exposure of credentials or device compromise. Immediate actions include revoking any entered credentials, particularly Google account passwords, and enabling multi-factor authentication on all linked accounts. Devices used to access the site should be scanned for malware using updated security tools. If financial or cryptocurrency transactions were initiated, affected users should contact their financial institutions to report potential fraud. Monitoring for unauthorized account activity is strongly recommended, and any suspicious communications referencing this domain should be disregarded.