sui[.]hub-airdropalert[.]cfd

The domain sui.hub-airdropalert.cfd poses a specific threat as a Google credential phishing page, designed to trick users into entering sensitive login information under the guise of a legitimate Google interface. The page title was explicitly set to 'Google,' indicating a direct attempt to impersonate the brand. The domain is now offline, but while active, it could have been used to harvest usernames, passwords, or two-factor authentication codes from visitors. Infrastructure analysis shows the domain resolved to IP address 142.250.65.228, which is associated with Google's own infrastructure, suggesting the phishers may have used a compromised or misconfigured host to serve the phishing content.

Evidence from threat intelligence feeds confirms the domain was registered on November 09, 2025, through Dynadot LLC. VirusTotal analysis shows 8 out of 95 security vendors flagged the domain as malicious, and it appears on 1 security blocklist. The Gridinsoft trust score is 0 out of 100, reflecting a high likelihood of malicious intent. The unique seed identifier 5619ec was used to track this investigation. The domain was taken offline by PhishDestroy, a takedown service, indicating active mitigation.

Users who visited sui.hub-airdropalert.cfd should immediately change their Google account passwords and enable two-factor authentication if not already active. They should review recent account activity for unauthorized access, especially login attempts from unrecognized IP addresses or devices. It is also advisable to run a full antivirus scan on the device used to access the domain, as phishing pages may deliver malware. Users should report the incident to Google's security team via their account recovery or phishing reporting tools.