cetus[.]airdropalerts[.]bond

Analysis of cetus.airdropalerts.bond indicates a high‑risk brand‑impersonation campaign targeting Google users with a fake airdrop lure. The domain was registered on 14 October 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to 192.178.155.106, an address announced by AS15169 owned by Google LLC and located in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both hosted by Cloudflare. No TLS certificate is presented, leaving the site accessible only over HTTP.

Google Safe Browsing flags the URL for social engineering twice, and VirusTotal records 11 of 95 scanners labeling the domain as malicious. The site appears on a single security blocklist and has been actively blocked by PhishDestroy. Reputation services assign extremely low trust scores: Gridinsoft 0/100 and Scamadviser 1/100. The page title returned is “Google”, matching the declared brand target and confirming the intent to masquerade as a Google service.

The scam type is identified as a “Fake Airdrop”, suggesting the payload likely attempts to harvest credentials or cryptocurrency wallet information. Uncertainty remains regarding the exact content served before takedown, as no SSL certificate or detailed page capture is available. Defenders should add the IP address 192.178.155.106 and the domain cetus.airdropalerts.bond to inbound and outbound filtering rules, monitor for DNS queries to the associated Cloudflare nameservers, and ensure that any internal communications referencing Google airdrop promotions are scrutinized. Continuous threat‑intel feeds should be consulted for any re‑use of the infrastructure, and users should be educated to reject unsolicited airdrop offers that claim to originate from Google.