degen[.]airdrpsalert[.]click

The domain degen.airdrpsalert.click is a phishing site engaged in brand impersonation targeting Google. It presents itself as a legitimate Google page to deceive users into entering credentials or other sensitive information. No crypto drainer kit was identified, but the site poses an elevated risk due to its deceptive nature. As of the latest verification, degen.airdrpsalert.click has been taken offline.

Technical indicators confirm the domain's malicious intent. degen.airdrpsalert.click was flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and SOCRadar, and appears on 1 security blocklist (PhishDestroy). The domain was registered through Dynadot LLC on October 26, 2025, and resolves to the IP address 142.250.185.164, hosted on Google LLC's infrastructure (AS15169). No SSL certificate was issued for the domain, and the observed page title was 'Google'. Nameservers are provided by Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com).

Users who interacted with degen.airdrpsalert.click should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) to add an extra layer of security. Monitor accounts for unauthorized activity and report any suspected fraud to the impersonated brand's support team. The domain can be reported to Google Safe Browsing, PhishTank, or the registrar (Dynadot LLC) for further action.