dot[.]airdropalerts[.]icu

Analysis of dot.airdropalerts.icu, observed on July 23, 2026, indicates a high‑risk brand‑impersonation campaign targeting Google users with a fake airdrop narrative. The domain was registered through Dynadot LLC on October 14, 2025 and resolves to the IPv6 address 2607:f8b0:4004:c25::6a, which belongs to AS15169, Google LLC, United States. The hosting provider therefore appears to be a Google‑owned network, a tactic often used to lend credibility to malicious infrastructure. No SSL certificate is presented for the site, leaving traffic unencrypted and exposing visitors to potential credential capture. The page title returned by HTTP requests is simply "Google," reinforcing the impersonation claim.

Google Safe Browsing classifies the URL as a social‑engineering threat, and 14 of 95 security vendors on VirusTotal have flagged the domain, confirming broader detection consensus. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme malicious confidence. Nameserver resolution points to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS services.

Current operational status is offline, suggesting the site has been taken down or is temporarily inaccessible. Defenders should continue to block the IPv6 address and associated domain at perimeter firewalls, update URL filtering rules to include dot.airdropalerts.icu, and monitor for any re‑registration attempts. Given the use of a Google‑owned IP range and the lack of TLS, any future re‑hosting on the same address space should be treated as suspicious until verified. Continuous threat‑intel feeds should be consulted for re‑emergence, and users should be warned not to engage with unsolicited airdrop offers that claim to originate from Google.