metis[.]airdropsalert[.]icu

This domain, metis.airdropsalert.icu, poses a targeted brand impersonation threat against Gmail users. Analysis indicates the domain was designed to mimic legitimate Google login pages, as evidenced by its page title 'Google' and direct association with Gmail's branding. The intent was likely to harvest credentials by presenting a fraudulent interface indistinguishable from authentic Google services, exploiting user trust in the Gmail brand to facilitate unauthorized access to accounts or sensitive information.

Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered through Dynadot LLC on October 17, 2025, and resolved to IP address 142.250.185.228, hosted on AS15169 (Google LLC infrastructure). Despite leveraging Google's network, the domain lacked an SSL certificate, a deviation from standard security practices. Security vendors flagged the domain in 14 out of 95 VirusTotal scans, and it appeared on one security blocklist prior to being taken offline. The absence of encryption and its short operational window suggest a deliberate, short-term phishing campaign.

Users who visited metis.airdropsalert.icu should assume potential credential exposure. Immediate actions include resetting Gmail passwords using multi-factor authentication and reviewing account activity for unauthorized logins or changes. If credentials were entered, enable additional security measures such as app-based verification and monitor linked accounts for suspicious behavior. Organizations should update internal blocklists to include this domain and its resolving IP, while users should verify the legitimacy of any unexpected login prompts or emails referencing Gmail services.