plume[.]airdropsalert[.]live

The domain plume.airdropsalert.live was observed targeting the Gmail brand through a fabricated airdrop scheme. The site was taken offline before the analysis was completed, and the takedown was credited to the PhishDestroy mitigation service. During the brief window of activity the HTTP response returned a status code 200, indicating a reachable web server, but no SSL certificate was presented, leaving the connection unencrypted. The page title reported by the crawler was "Google", which aligns with the impersonation of the Gmail brand but provides no additional visual or functional context.

Infrastructure analysis shows the domain resolved to IP address 216.58.206.68, an address owned by Google LLC (ASN 15169) and geolocated to Germany. The registration was performed through Cloudflare, Inc., while the nameserver data could not be retrieved (NS_NOT_FOUND). VirusTotal scans recorded 13 detections out of 95 participating security vendors, confirming that multiple threat intelligence feeds consider the domain malicious. The domain appears on a single external blocklist, suggesting limited but existing dissemination among defensive communities.

Uncertainty remains around the exact phishing kit employed, the content of the landing page, and any credential harvesting mechanisms that may have been active before takedown. Defensive operators should continue to block the domain at DNS and network layers, monitor Cloudflare‑registered subdomains for similar patterns, and update URL filtering policies to include the observed IP address and any future resolutions that point to the same infrastructure. Continuous re‑scanning of the domain on multi‑vendor platforms is advised to capture any changes in detection scores, and analysts should correlate any related alerts that reference the fake airdrop narrative with the Gmail brand to expedite response actions.