stellar[.]airsdropalert[.]click

This domain, stellar.airsdropalert.click, is identified as a brand impersonation threat designed to mimic Gmail login interfaces. Analysis indicates the site employed deceptive page elements, including a 'Google' page title, to trick users into entering credentials. No drainer kit signatures were observed, but the domain's infrastructure aligns with credential harvesting campaigns targeting webmail services.

Technical indicators confirm elevated risk: the domain was flagged by 15 of 95 security vendors on VirusTotal, registered through Dynadot LLC on November 5, 2025, and resolved to IP address 192.178.155.103. It appeared on one security blocklist and used an SSL certificate issued by Google Trust Services (WE1), likely to enhance legitimacy. Google Safe Browsing status was not explicitly recorded, but the domain's offline status suggests takedown actions.

While stellar.airsdropalert.click is currently offline, residual risk persists. Users who interacted with the domain should rotate credentials immediately, particularly if login attempts were made. Organizations are advised to monitor for related infrastructure, such as the linked IP or registrar, and update blocklists to include the domain and associated indicators. The creation date and detection ratio suggest this was part of a broader, short-lived phishing operation targeting cloud service credentials.