recall[.]airdrpsalerts[.]click

This domain, recall.airdrpsalerts.click, operates as a credential harvesting phishing site specifically designed to impersonate Gmail login interfaces. Analysis of the page title, which displays 'Google,' and the domain's infrastructure confirms it targets users attempting to access legitimate Gmail services. The site employs social engineering tactics to deceive victims into entering their login credentials, which are then captured by threat actors for unauthorized account access, data exfiltration, or further malicious campaigns such as business email compromise (BEC) or lateral movement within compromised networks. Evidence supporting this assessment includes a VirusTotal detection rate of 14 out of 95 security vendors, indicating moderate consensus among security tools regarding its malicious nature. The domain was registered on November 04, 2025, through Dynadot LLC, a registrar frequently observed in phishing infrastructure. It appears on at least one security blocklist and resolves to the IP address 142.250.185.164, which is geolocated to the United States under AS15169 (Google LLC). Notably, the domain lacks an SSL certificate, a red flag for users accustomed to secure connections on legitimate login pages. The combination of these technical indicators—absence of encryption, recent registration, and blocklist inclusion—reinforces the elevated risk classification. Users who visited recall.airdrpsalerts.click or entered credentials on this site should immediately take corrective action. First, change the password for the affected Gmail account and any other accounts using the same credentials. Enable multi-factor authentication (MFA) using an authenticator app or hardware key, avoiding SMS-based methods where possible. Review the account for unauthorized access, including checking login activity, connected apps, and email forwarding rules. If financial or sensitive data was accessed, monitor for signs of identity theft or fraudulent transactions. Organizations should consider isolating any devices that interacted with the domain and conducting a forensic review to assess potential compromise of corporate credentials or data.