threshold[.]airdrpsalerts[.]cfd

The domain threshold.airdrpsalerts.cfd is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page to deceive users into disclosing credentials or other sensitive information. No crypto drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk but not eliminating the potential for future reactivation or similar threats.

Technical indicators confirm the malicious nature of threshold.airdrpsalerts.cfd. As of analysis, 2 of 95 VirusTotal security vendors flagged the domain, including ChainPatrol and SOCRadar. The domain was registered through Dynadot LLC on October 29, 2025, and resolves to the IP address 142.250.185.196, hosted under AS15169 Google LLC in the US. It appears on 1 security blocklist, PhishDestroy, and lacks an SSL certificate. The observed page title was 'Google', reinforcing its impersonation attempt. Nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and Gridinsoft assigned a trust score of 0/100.

Users who interacted with threshold.airdrpsalerts.cfd should immediately change any passwords entered on the site, particularly for Google accounts, and enable two-factor authentication (2FA) if not already active. Monitor accounts for unauthorized activity and report any fraudulent transactions. To mitigate future risk, avoid clicking on suspicious links and verify domain authenticity before entering credentials. Report the phishing domain to Google’s Safe Browsing team, the registrar Dynadot LLC, and platforms like PhishTank or the Anti-Phishing Working Group (APWG) to aid in takedown efforts.