eth[.]airdrpsalert[.]cfd

The domain eth.airdrpsalert.cfd has been identified as a brand impersonation threat specifically targeting Gmail users. This domain is currently offline, but its recent activity posed a significant risk of credential theft. The site was designed to mimic Google's login page, as indicated by its page title of "Google," in an attempt to deceive users into entering their email credentials.

Technical analysis reveals that this domain was registered through Dynadot LLC on October 22, 2025, and resolves to IP address 142.250.185.164. VirusTotal data shows that 11 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. Notably, the domain lacks an SSL certificate, which is a red flag for any legitimate login page. These indicators collectively underscore the domain's malicious intent.

Given that eth.airdrpsalert.cfd is now offline, the immediate threat has been mitigated. However, users should remain vigilant against similar phishing attempts. PhishDestroy recommends that users always verify the URL before entering credentials, enable two-factor authentication, and report any suspicious domains to security teams. If you have already entered information on this site, change your Gmail password immediately and monitor for unauthorized access.