eth[.]airdrpsalert[.]lol

The domain eth.airdrpsalert.lol has been identified as a brand impersonation threat, specifically targeting Gmail users. This domain attempts to deceive visitors by presenting a fraudulent login page titled "Google," designed to harvest credentials and sensitive information from unsuspecting individuals. The site's name suggests a fake airdrop alert, a common lure used in crypto-related phishing campaigns, though the primary target here is Gmail credentials. Security analysis confirms this domain is a confirmed phishing site with a clear intent to commit identity theft and unauthorized account access.

Technical indicators paint a clear picture of malicious activity. VirusTotal reports that 4 out of 95 security vendors flag this domain as malicious, a significant detection rate given the domain's recent creation on October 22, 2025. The domain is registered through Dynadot LLC and resolves to IP address 172.253.62.106, which has been associated with other phishing operations. It appears on one security blocklist and holds no SSL certificate, a critical red flag for any site requesting login credentials. Google Safe Browsing (GSB) status is not provided, but the domain's current status is offline, suggesting it has been taken down after detection.

Currently, the domain is offline, likely due to takedown efforts by security researchers or hosting providers. However, the risk remains that similar domains may appear under different names or IP addresses. Users who may have interacted with this site should immediately change their Gmail passwords and enable two-factor authentication. It is also advisable to monitor accounts for suspicious activity and report any unauthorized access. PhishDestroy recommends blocking this domain and educating users about brand impersonation scams, particularly those involving fake airdrop alerts that trick users into entering credentials on lookalike login pages.