usual[.]airdropalerts[.]bond

The domain usual.airdropalerts.bond has been identified as a confirmed brand impersonation phishing site, specifically targeting Gmail users. As of the latest analysis, the site is offline, but its malicious intent has been thoroughly documented. This domain was created on October 14, 2025, and registered through Dynadot LLC, a common registrar for fraudulent domains. The page title was set to "Google" to deceive visitors into believing they were accessing a legitimate Gmail login page.

PhishDestroy's investigation reveals that this phishing domain was flagged by 10 out of 95 security vendors on VirusTotal, indicating a moderate but notable detection rate. The domain resolves to IP address 142.250.185.100, which is associated with Google services, further aiding its impersonation. Despite being offline, the domain appears on one security blocklist, underscoring its recognition as a threat. Notably, the site lacked an SSL certificate, a red flag for any site handling sensitive information like login credentials.

Given that usual.airdropalerts.bond is now offline, users are no longer at immediate risk from this specific domain. However, PhishDestroy recommends that anyone who may have interacted with this site—especially if they entered any credentials—should immediately change their Gmail password and enable two-factor authentication. Users should remain vigilant against similar phishing attempts that mimic well-known brands like Gmail, and always verify the legitimacy of URLs before entering personal information. For ongoing protection, consider using a reputable security solution that can identify and block such threats in real time.