send[.]airsdropalert[.]click

This domain, send.airsdropalert.click, is actively engaged in credential harvesting phishing operations targeting users through deceptive landing pages. Analysis indicates the site mimics legitimate cryptocurrency airdrop alerts to trick visitors into submitting sensitive login credentials, wallet recovery phrases, or personal information. The infrastructure is designed to appear authentic, leveraging social engineering tactics to exploit user trust in promotional offers or reward systems. Infrastructure analysis reveals the domain was registered on November 05, 2025, through Dynadot, LLC, and currently resolves to the IP address 188.114.97.3. Security vendor detections on VirusTotal stand at 14 out of 95, with one additional security blocklist flagging the domain. The SSL certificate is issued by Google Trust Services (WE1), and the page title displays the default "Welcome to nginx!" banner, suggesting either misconfiguration or intentional obfuscation of malicious intent. The domain remains active and unmitigated as of the latest verification. Users who have visited send.airsdropalert.click or interacted with its content should immediately revoke any submitted credentials and monitor associated accounts for unauthorized activity. If login details or recovery phrases were entered, affected accounts must be secured by changing passwords and enabling multi-factor authentication where available. Devices used to access the site should undergo a full security scan to detect potential malware or backdoors. Network administrators are advised to block the domain and its resolving IP (188.114.97.3) at the perimeter to prevent further exposure.