mmt[.]airdrpsalert[.]cfd

This domain is classified under an elevated risk level for credential-phishing activity. Analysis indicates it is designed to harvest user credentials through deceptive login portals or fraudulent authentication prompts, a common tactic in targeted phishing campaigns. Infrastructure analysis reveals the domain was registered on October 22, 2025, through Dynadot LLC. It resolves to the IP address 104.21.84.155 and is currently listed on one security blocklist, with detection by 11 out of 95 security vendors on VirusTotal. The Gridinsoft trust score for this domain is 0/100, reflecting a complete lack of legitimacy. The domain is presently offline, displaying a 504: Gateway time-out error, which may indicate temporary takedown or infrastructure adjustments by the threat actor. To mitigate risks associated with credential-phishing domains like airdrpsalert.cfd, organizations should implement the following measures: block the domain and its resolving IP at the network perimeter; deploy email filtering rules to quarantine messages containing links to this domain; and conduct user awareness training focused on recognizing phishing indicators, such as mismatched URLs, urgent login requests, or unsolicited authentication prompts. Additionally, monitor for unauthorized access attempts tied to credentials potentially exposed through this infrastructure.