nexusmutual[.]app-airdropalert[.]lat

The domain nexusmutual.app-airdropalert.lat is identified as a brand impersonation threat specifically targeting Gmail users. This domain presents itself as a legitimate Gmail login portal, a tactic commonly employed to harvest user credentials through deceptive interfaces. Analysis confirms the domain is currently offline, though prior activity indicates a deliberate attempt to mimic Google’s authentication infrastructure. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered through Dynadot LLC on November 10, 2025, and resolves to the IP address 142.250.185.68, which is atypical for a newly created phishing site. Security assessments show the domain appears on one blocklist, while VirusTotal reports 12 of 95 security vendors flagging it as malicious. Notably, the domain lacks an SSL certificate, a critical red flag for any site handling sensitive user data. The page title, 'Google,' further reinforces the intent to deceive users into believing they are interacting with a legitimate service. Current status indicates the domain has been taken offline, likely due to detection and mitigation efforts. However, the infrastructure and registration details suggest potential for re-emergence under a similar or altered domain. Users are advised to verify domain authenticity before entering credentials, particularly when redirected from unsolicited links. Organizations should monitor for related domains registered through the same registrar and IP range, as these may indicate coordinated phishing campaigns. Immediate reporting of suspicious domains to security teams and blocklisting of known malicious indicators are recommended to prevent credential theft and unauthorized access.