send[.]airsdropsalert[.]cfd

PhishDestroy has identified send.airsdropsalert.cfd as an elevated-risk brand impersonation threat specifically targeting Gmail users. The site was designed to mimic the Google login page to harvest credentials, a common tactic in credential phishing campaigns. Although currently offline, organizations and individuals should remain vigilant as similar domains may resurface.

This domain was registered on November 05, 2025, via Dynadot LLC and resolved to IP address 216.58.206.36. VirusTotal analysis shows 13 out of 95 security vendors flagged the domain as malicious, and it appears on one security blocklist. The SSL certificate was issued by Google Trust Services (WE1), and the page title was simply "Google"—a classic impersonation technique. These technical indicators, combined with the low trust score and confirmed phishing behavior, strongly suggest active malicious intent.

To protect against Gmail credential phishing, users should always verify the URL before entering login credentials and enable two-factor authentication (2FA) on their accounts. Organizations should deploy web filtering solutions to block known malicious domains and educate employees about recognizing suspicious login pages. Any credentials entered on this site should be reset immediately, and affected accounts should be monitored for unauthorized access.