gettrumpairdrop[.]web[.]app

The domain gettrumpairdrop.web.app is currently active and engaged in brand_impersonation, specifically targeting Apple. Analysis confirms this domain is designed to deceive users by mimicking official Apple promotions, likely through fraudulent airdrop or giveaway schemes. The page title, 'The Official Trump Meme | GetTrumpMemes,' further obscures its true intent, potentially increasing its effectiveness in social engineering attacks. Infrastructure analysis reveals the domain is flagged by 9 of 95 security vendors on VirusTotal, indicating a high level of detection for malicious activity. It appears on one security blocklist and is blocked by PhishDestroy. The domain resolves to the IP address 199.36.158.100, hosted by Fastly, Inc. (AS54113) in the United States. The SSL certificate is issued by Google Trust Services under the identifier WR4, and the domain is registered through Google LLC. Despite these red flags, the domain remains operational, posing an ongoing risk to users. Current status indicates the domain is still active, and the risk level is classified as high due to its deceptive practices and confirmed malicious detections. Organizations and users are advised to block this domain at the network level and implement real-time monitoring for related indicators of compromise. Security teams should prioritize awareness training to educate users on recognizing brand impersonation tactics, particularly those involving high-profile technology companies. Immediate action is recommended to mitigate exposure to this threat.