abstract[.]airdrpsalerts[.]cfd

The domain abstract.airdrpsalerts.cfd is a confirmed phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page to deceive users into disclosing sensitive information, such as login credentials. No crypto drainer kit was identified in this campaign. The site is currently taken offline, but its prior activity poses an elevated risk to users who may have interacted with it.

Technical analysis of abstract.airdrpsalerts.cfd reveals limited detection by security vendors, with only 2 of 95 VirusTotal vendors flagging it as malicious, including ChainPatrol and SOCRadar. The domain was registered through Dynadot LLC on October 29, 2025, and resolves to the IP address 142.250.185.196, hosted on Google LLC's infrastructure in the US. It appears on one security blocklist, PhishDestroy, and lacks an SSL certificate. The observed page title was 'Google,' reinforcing its impersonation of the brand. Nameservers are hosted on Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com).

Users who visited abstract.airdrpsalerts.cfd should immediately change any passwords entered on the site, particularly for Google accounts, and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google’s Safe Browsing team via their reporting tool and to the registrar, Dynadot LLC, to aid in takedown efforts. If financial or personal data was exposed, consider contacting relevant institutions to secure accounts.