cetus[.]airdropalerts[.]icu

The domain cetus.airdropalerts.icu is identified as a high-risk brand impersonation threat targeting Gmail. This domain has been used to impersonate Google's login page, potentially to steal user credentials and other sensitive information. The threat does not involve a crypto drainer kit but is designed to deceive users into believing they are interacting with a legitimate Google service.

Infrastructure analysis reveals that cetus.airdropalerts.icu has been flagged by 13 out of 95 security vendors on VirusTotal, indicating a moderate level of detection. The domain is registered through Dynadot LLC and resolves to the IP address 142.250.186.36, which is located in the United States and is part of AS15169, owned by Google LLC. The domain was created on October 14, 2025, and has been flagged by Google Safe Browsing as a phishing site. It also appears on one security blocklist, further confirming its malicious nature.

Currently, the domain is offline, which suggests that it has been taken down or is no longer active. However, the infrastructure and techniques used in this brand impersonation campaign may still pose a risk if reactivated. It is recommended that users remain vigilant and avoid visiting any unfamiliar or suspicious domains that claim to be associated with Gmail. Security teams should monitor for any similar domain registrations and ensure that appropriate measures are in place to block and detect such threats.