usual[.]airdropalerts[.]icu

This domain, usual.airdropalerts.icu, is identified as a brand impersonation threat targeting Gmail. The domain was used to impersonate Google's login page, potentially to steal user credentials and sensitive information. No specific drainer kit or malware distribution infrastructure has been identified, but the domain's purpose is clearly to deceive users into believing it is an official Google service.

Infrastructure analysis reveals that the domain was registered through Dynadot LLC on October 14, 2025. It resolves to the IP address 142.250.184.196, which is located in the United States and is part of AS15169, operated by Google LLC. The domain has a VirusTotal (VT) score of 12/95, indicating that 12 out of 95 security vendors flag this domain as malicious. The domain does not have an SSL certificate, which is a common indicator of a lack of security and trustworthiness. As of the investigation, the domain appears on 1 security blocklist and has been taken offline by PhishDestroy.

Currently, the domain is offline, which mitigates the immediate risk of further phishing attacks. However, the domain's presence on a security blocklist and the VT score suggest that it was actively used for malicious activities before being taken down. Despite the domain being offline, there remains a risk that it could be reactivated or used in a different form. Users are advised to remain vigilant and avoid clicking on unsolicited links or entering personal information on unfamiliar websites, even if they appear to be legitimate. Organizations should also update their security protocols to include this domain in their threat intelligence databases and ensure that network traffic to this domain is blocked.