arb[.]airdropsalert[.]app

This domain, arb.airdropsalert.app, is identified as a high-risk brand impersonation threat specifically targeting Gmail users. Analysis indicates the page title was set to 'Google,' mimicking the legitimate Gmail login interface to deceive users into entering credentials. No evidence of a crypto drainer kit or additional payload delivery was observed in the available intelligence, but the domain’s primary objective appears to be credential harvesting through a fake login portal. Technical indicators confirm the domain’s malicious nature. VirusTotal detection shows 16 out of 95 security vendors flagging arb.airdropsalert.app as malicious. The domain was registered through Cloudflare, Inc., a common registrar for both legitimate and malicious infrastructure. It resolved to the IP address 142.250.185.68, which is associated with Google LLC (AS15169) in the United States, though this IP is likely spoofed or misconfigured to appear legitimate. Google Safe Browsing explicitly flags the domain as phishing. The domain appears on one security blocklist, and no SSL certificate was detected, further indicating its suspicious nature. The creation date of the domain is not provided, but the infrastructure aligns with short-lived phishing campaigns. As of the latest intelligence, arb.airdropsalert.app has been taken offline, reducing immediate risk to users. The domain was blocked by at least one security provider, and its removal from active DNS resolution suggests mitigation efforts were successful. However, residual risk remains for users who may have interacted with the domain prior to its takedown. Organizations are advised to monitor for credential reuse attempts, particularly targeting Gmail accounts, and to review logs for connections to the domain or its associated IP. Users should be alerted to verify domain authenticity before entering credentials, especially when redirected from unsolicited links or third-party notifications.