mole[.]airsdropsalert[.]cfd

This domain, mole.airsdropsalert.cfd, poses a specific threat as a brand impersonation phishing site targeting Gmail users. The page title displayed is 'Google', designed to trick visitors into believing they are on a legitimate Google login page. The threat is a credential harvesting attack: unsuspecting users who enter their email and password risk having their Gmail account compromised, which could lead to further account takeovers, identity theft, or financial fraud. The domain's name, 'airsdropsalert.cfd', is a common tactic used by scammers to create a sense of urgency around cryptocurrency airdrops, luring victims to the fake login.

Evidence of malicious intent is substantial. VirusTotal analysis shows 16 out of 95 security vendors flag this domain as malicious, a clear indicator of widespread detection. The domain appears on one security blocklist and was registered on November 5, 2025, through Dynadot LLC, a registrar often associated with high-risk domains. It resolves to IP address 216.58.206.36 and uses an SSL certificate from Google Trust Services (WE1), which gives the fake page a veneer of legitimacy. Despite being taken offline, the domain's short lifespan and the phishing indicators point to a coordinated attack.

If you visited this domain, do not enter any information. Immediately change your Gmail password and enable two-factor authentication if you have not already. Check your account for suspicious activity and revoke access to any third-party apps that you may have granted permissions. Report the domain to Google's Safe Browsing and to PhishDestroy to help protect others. Stay vigilant against similar domains that combine urgency with fake login pages.