wct[.]airdrpsalerts[.]info

This domain, wct.airdrpsalerts.info, is identified as a brand impersonation threat targeting Gmail users. Analysis indicates the site masquerades as a legitimate Google login portal, as evidenced by its page title 'Google' and confirmed intelligence pointing to credential theft objectives. No evidence of crypto drainer functionality or associated malware payloads was observed, distinguishing this campaign as a focused credential harvesting operation. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolves to the IP address 172.217.165.132, geolocated within the United States under AS15169 (Google LLC). Despite the IP’s association with a legitimate provider, the domain itself lacks an SSL certificate, increasing its detectability. Detection metrics show 14 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. The domain’s current status is offline, though no historical WHOIS data or creation date was available for temporal analysis. The domain’s takedown mitigates immediate risk, though residual threats persist due to the potential for infrastructure reuse or re-registration under altered identifiers. The use of a legitimate IP range to host malicious content underscores the need for layered detection mechanisms, including behavioral analysis and real-time domain reputation checks. Organizations and users are advised to monitor for similar impersonation attempts, particularly those leveraging recognizable brands via newly registered domains. Enforcement of strict certificate validation and multi-factor authentication remains critical to mitigating credential theft risks associated with such campaigns.