mon[.]airdropsalert[.]us

The domain mon.airdropsalert.us is identified as a brand impersonation threat targeting Google. This domain was designed to deceive users into believing they were interacting with legitimate Google services, potentially for credential theft or other malicious activities.

Technical indicators show that mon.airdropsalert.us has a VirusTotal score of 11/95, indicating a significant level of detection by security vendors. The domain is registered through Dynadot LLC and resolves to the IP address 142.250.190.228, which is located in the United States and associated with AS15169 Google LLC. The domain was created on October 18, 2025, and currently appears on 1 security blocklist. Despite the IP's association with Google, the lack of an SSL certificate and the domain's presence on blocklists suggest it is not a legitimate Google service.

The domain is currently offline, which has reduced the immediate risk to users. However, it remains important for organizations and individuals to be vigilant and ensure that security measures are in place to detect and block any future reactivation. Actions such as blocking the domain at the network level and educating users about the risks of brand impersonation can help mitigate potential threats. The domain's elevated risk level and previous detection by security vendors indicate that it may still pose a residual risk if reactivated.