plume[.]airdropsalert[.]icu

The domain plume.airdropsalert.icu is a phishing site engaged in brand impersonation, specifically targeting Google as part of an airdrop scam. It poses an elevated risk by deceiving users into believing they are interacting with a legitimate Google service, potentially leading to credential theft or financial loss. As of the latest verification, plume.airdropsalert.icu has been taken offline, though its prior activity remains a concern for those who may have encountered it.

Technical indicators confirm the malicious nature of plume.airdropsalert.icu. The domain was flagged by 14 of 95 security vendors on VirusTotal, including ChainPatrol, alphaMountain.ai, and BitDefender, and appears on one security blocklist (PhishDestroy). Registered through Dynadot LLC on October 17, 2025, the domain resolved to the IP address 192.178.155.99, hosted under AS15169 (Google LLC). No SSL certificate was present, and the observed page title was 'Google'. The domain used Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and had a Gridinsoft trust score of 0/100.

Users who interacted with plume.airdropsalert.icu should take immediate safety steps. If credentials were entered, change passwords for the affected account and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity and report any fraudulent transactions. To report the phishing domain, submit it to Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG). Victims of airdrop scams should also consider reporting the incident to local cybercrime authorities or platforms like the FBI’s Internet Crime Complaint Center (IC3).