polymarket[.]airdropalerts[.]icu

Analysis of the domain polymarket.airdropalerts.icu indicates it was a brand-impersonation phishing site targeting Google users through a fake airdrop scam. The domain, registered on October 14, 2025, via Dynadot LLC, was flagged by 14 of 95 security vendors on VirusTotal and appeared on one security blocklist, as recorded by PhishDestroy. The page title 'Google' aligns with the reported brand target, suggesting an attempt to deceive users into believing the site was affiliated with Google. Infrastructure analysis reveals the domain resolved to the IP address 216.58.206.68, geolocated in Germany under AS15169 (Google LLC), though this does not confirm legitimacy, as threat actors frequently abuse cloud and CDN services.

Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com were in use, indicating Cloudflare infrastructure, a common choice for both legitimate and malicious domains. No SSL certificate was detected, increasing the likelihood of interception or manipulation of user data. The domain has since been taken offline, though its prior activity and detection metrics confirm malicious intent. Defenders should treat this domain as a confirmed phishing indicator, particularly in contexts involving Google-branded promotions or airdrop scams.

The absence of an SSL certificate and the use of a recently registered domain further support its classification as high-risk. No additional scam mechanics or payloads were identified in the available data, and the exact content of the site remains unanalyzed. Network security teams are advised to block the domain and IP at perimeter controls and monitor for related infrastructure, such as similarly named subdomains or reused Cloudflare nameservers.