mon[.]airdropalerts[.]icu

This domain, mon.airdropalerts.icu, poses a direct threat as a brand impersonation phishing site designed to mimic Gmail login interfaces. The objective is to deceive users into entering legitimate credentials, which are then harvested for unauthorized access to email accounts, financial fraud, or further phishing campaigns. The page title 'Google' and the domain structure suggest an attempt to exploit trust in Google’s brand, potentially targeting users expecting airdrop or promotional notifications. The use of a subdomain (mon) under a seemingly benign parent domain (airdropalerts.icu) increases the likelihood of successful deception, particularly among users accustomed to receiving alerts from promotional platforms.

Analysis of the domain’s infrastructure reveals multiple red flags. The domain was registered on October 14, 2025, through Dynadot LLC, a registrar frequently abused for malicious activity. It resolves to the IP address 142.250.184.196, which belongs to AS15169 (Google LLC), though this is likely a misdirection or misconfiguration rather than a legitimate hosting arrangement. The domain lacks an SSL certificate, a critical omission that would expose user-submitted credentials in plaintext. Security vendors on VirusTotal flagged the domain as malicious in 12 out of 95 detections, and it appears on at least one security blocklist. The domain’s current offline status suggests takedown action, but its infrastructure may be reactivated or repurposed for future campaigns.

Users who visited mon.airdropalerts.icu or entered credentials on the site should assume their Gmail account has been compromised. Immediate steps include changing the account password using a secure device, enabling multi-factor authentication (MFA) with an authenticator app or hardware key, and reviewing recent account activity for unauthorized logins or sent messages. Users should also check connected apps and revoke access for any unfamiliar services. If financial or sensitive information was shared, monitor accounts for fraudulent activity and consider reporting the incident to relevant authorities. Organizations should update blocklists to include this domain and its associated IP address, even if currently offline, to prevent future exposure.