momentum[.]airsdropalert[.]click

This domain, momentum.airsdropalert.click, is identified as a brand impersonation threat specifically targeting Gmail credentials. The infrastructure mimics Google's login interface, as evidenced by the page title 'Google' and the use of a Google Trust Services SSL certificate (WE1). No direct association with known crypto drainer kits has been confirmed, though the domain's structure and hosting pattern align with credential harvesting operations typically used in account takeover schemes.

Analysis indicates the domain was registered on November 5, 2025, through Dynadot LLC and resolves to the IP address 216.58.206.68, geolocated in Germany under AS15169 (Google LLC). VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was previously blocked by at least one threat intelligence feed. Despite its association with Google's IP range, the hosting context and registration details deviate from legitimate Google infrastructure, reinforcing its fraudulent nature.

As of the latest verification, momentum.airsdropalert.click has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the domain's registration remains active, posing a residual risk of reactivation or migration to alternative infrastructure. Users who may have interacted with the site are advised to reset Gmail credentials immediately, enable multi-factor authentication, and review connected applications for unauthorized access. Organizations should monitor for similar domains registered via Dynadot or resolving to Google LLC IPs for credential harvesting patterns.