wct[.]airdrpsalerts[.]life

This report details a phishing threat targeting Google users. The domain wct.airdrpsalerts.life presented a page titled "Google" and was identified as a Google Phishing scam, attempting to impersonate the Google brand to steal user credentials. The primary threat is credential theft from visitors who believe they are interacting with a legitimate Google service.

Technical analysis confirms the malicious nature of the site. VirusTotal reported 7 out of 95 security vendors flagged the domain as malicious. It was flagged by ChainPatrol, CyRadar, ESET, Forcepoint ThreatSeeker, and Seclookup. The domain is listed on 1 blocklist. It was registered through Cloudflare, Inc. and hosted on IP address 142.250.184.228, which is located in the United States and belongs to AS15169 Google LLC. The SSL certificate was issued by Google Trust Services / WE1.

The domain wct.airdrpsalerts.life is currently reported as DOWN or OFFLINE, rendering it inaccessible. The risk level is high for users who may have visited the site while it was active, as they could have been exposed to a credential harvesting attack. Given its offline status, the immediate threat is neutralized, but the domain remains on security blocklists.