momentum[.]airdropalerts[.]icu

Analysis of momentum.airdropalerts.icu indicates that the domain is currently offline but was previously used to host a fraudulent airdrop page that mimics Google. The domain was registered on 14 October 2025 through Dynadot LLC and uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to IP address 142.250.185.100, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. No TLS certificate is presented for the host, confirming the absence of HTTPS protection. The page title returned by the server was “Google”, matching the declared brand target and confirming the intent to impersonate Google.

The scam type is identified as a “Fake Airdrop”, a common vector for credential harvesting and token theft. Threat intelligence feeds have flagged the domain on ten of ninety‑five VirusTotal scanners, and it appears on one public blocklist. The domain is also listed as blocked by the PhishDestroy service, indicating that at least one anti‑phishing platform has taken mitigation action. No additional Safe Browsing, OTX, or other reputation data were observed. The combination of a recent registration date, use of legitimate‑looking Cloudflare infrastructure, and an IP address that belongs to the legitimate target organization is a classic evasion technique that can increase user trust.

Defenders should continue to monitor the domain for any re‑activation, enforce network‑level blocking of the domain and its associated IP, and update URL filtering policies to include the known host. Email security gateways should be tuned to detect references to “airdrop” or “Google” in conjunction with suspicious URLs. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to reset passwords and review account activity.