hydration[.]airdropsalert[.]app

This domain, hydration.airdropsalert.app, operates as a high-risk credential harvesting site specifically designed to impersonate Gmail login interfaces. Analysis indicates the site presents a fraudulent Google-branded page to deceive users into submitting their email credentials, which are then captured by threat actors for unauthorized access or further malicious activity. The targeted nature of this impersonation—focusing on Gmail—amplifies the risk, as compromised accounts may lead to data breaches, identity theft, or lateral movement within connected services. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain resolves to the IP address 142.250.185.132, which is geolocated to the United States under AS15169 (Google LLC), though this appears to be a misdirection or hijacked infrastructure. Despite the Google-associated IP, the domain lacks a valid SSL certificate, a critical red flag for phishing sites. It is registered through Cloudflare, Inc., a common registrar for both legitimate and malicious domains, and is currently flagged by one security blocklist. VirusTotal detection metrics show 17 out of 95 security vendors have classified this domain as malicious, while Google Safe Browsing explicitly labels it as a phishing site. The page title, 'Google,' further corroborates the intent to mimic official Google properties. Users who visited hydration.airdropsalert.app or entered credentials on the site should immediately take corrective action. First, reset the password for the affected Gmail account using a secure device and enable multi-factor authentication if not already active. Review recent account activity for unauthorized logins or suspicious actions, such as sent emails, password changes, or connected applications. If financial or sensitive data was accessed via the compromised account, monitor for signs of identity theft or fraud. Additionally, scan the device used to access the site for malware, as phishing pages may deploy secondary payloads. Report the incident to the targeted brand’s security team and consider notifying relevant data protection authorities if personal information was exposed.