mmt[.]airdrpsalerts[.]info

This domain, mmt.airdrpsalerts.info, is flagged for brand_impersonation targeting Gmail users through credential harvesting. Analysis indicates the phishing page uses the title 'Google' to mimic legitimate login interfaces, attempting to deceive users into submitting account credentials. No drainer kit signatures were identified in initial scans, though the domain structure suggests potential for credential interception and exfiltration. Infrastructure analysis reveals the following technical indicators: VirusTotal detection score of 12/95 security vendors, registration through Cloudflare, Inc., and resolution to IP address 172.217.23.100. The domain currently lacks an SSL certificate, increasing exposure to interception risks. It appears on one security blocklist and was previously hosted on infrastructure associated with Google LLC (AS15169, IT). Creation date metadata remains unverified due to Cloudflare proxy obfuscation, though passive DNS records suggest recent activity. The domain has been taken offline, reducing immediate threat exposure. Response actions include blocklist inclusion by PhishDestroy and vendor detections on VirusTotal. Despite current inactivity, residual risk persists through cached pages or potential re-registration. Organizations should monitor for similar domains using the 'airdrpsalerts' subdomain pattern and enforce strict certificate validation for login portals. Users are advised to verify URL authenticity before entering credentials, particularly for Gmail-related services.