w[.]airdrpsalert[.]lol

The domain w.airdrpsalert.lol is a confirmed phishing site engaged in brand impersonation, specifically targeting Google. It poses a significant threat by attempting to deceive users into believing they are interacting with a legitimate Google service, potentially leading to credential theft or other fraudulent activities. The domain has been taken offline, reducing immediate risk, but its prior activity warrants caution for anyone who may have encountered it.

Technical analysis reveals that w.airdrpsalert.lol has been flagged by 3 of 95 VirusTotal vendors, including ChainPatrol, G-Data, and SOCRadar, indicating malicious detection. It is registered through Dynadot LLC and was created on October 22, 2025, resolving to IP address 172.253.63.147, which is located in the US and associated with AS15169 Google LLC. The domain appears on 1 security blocklist (PhishDestroy) and has no SSL certificate. Its page title was observed as 'Google', and it uses nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Google Safe Browsing did not flag this domain.

To stay safe, users who may have visited w.airdrpsalert.lol should change any passwords entered on the site immediately and enable two-factor authentication on their Google accounts. Monitor for unauthorized account activity or fraudulent charges. Report the domain to Google Safe Browsing and cybersecurity authorities to help prevent future attacks. Since no drainer kit was detected, token revocations are not required, but vigilance against similar phishing attempts is advised.