eth[.]airdrpsalert[.]club

The domain eth.airdrpsalert.club has been identified as a phishing resource engaged in brand impersonation targeting Gmail users. Analysis indicates the site was designed to mimic Google’s authentication interface, as evidenced by the page title 'Google' and the domain’s naming convention. The campaign appears to focus on credential theft, a common tactic in which threat actors replicate legitimate login portals to harvest account credentials. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively used in malicious operations. Infrastructure analysis reveals the domain was registered on October 26, 2025, through Dynadot LLC, a registrar frequently observed in phishing campaigns due to its accessibility and low-cost domain registration services. The domain resolved to the IP address 142.250.181.228, which is associated with Google LLC’s autonomous system (AS15169), a detail that may have been leveraged to lend an appearance of legitimacy. No SSL certificate was detected, a red flag for users accustomed to encrypted connections on legitimate platforms. Detection metrics indicate the domain was flagged by 11 of 95 security vendors on VirusTotal, while additional threat intelligence sources report its presence on at least one security blocklist. The combination of brand impersonation, lack of encryption, and low detection rates among vendors underscores the elevated risk posed by this campaign. Current status confirms eth.airdrpsalert.club is offline, though the infrastructure remains a potential vector for future malicious activity. Organizations and users are advised to implement proactive measures, including the deployment of DNS-based blocking rules to prevent resolution of the domain and its associated IP address. Network administrators should monitor for connections to 142.250.181.228 and other IPs within AS15169 that may exhibit similar patterns. End users should be trained to verify domain authenticity, particularly when prompted to enter credentials, and to report suspicious login pages to security teams. Given the domain’s registration through Dynadot LLC, additional scrutiny of newly registered domains from this registrar is recommended to mitigate similar threats.