aethir[.]airdrpsalerts[.]cfd

The domain aethir.airdrpsalerts.cfd is a confirmed phishing site engaged in brand impersonation targeting Google. It was designed to deceive users into believing they were interacting with a legitimate Google service, posing an elevated risk of credential theft or fraud. No crypto drainer kit was identified. The site is currently taken offline, but prior activity classifies it as a scam.

Technical indicators confirm the domain's malicious nature. As of analysis, 2 of 95 VirusTotal security vendors flagged aethir.airdrpsalerts.cfd, while it appeared on 1 security blocklist (PhishDestroy). The domain was registered through Dynadot LLC on October 29, 2025, and resolved to the IP address 172.217.18.4, hosted on Google LLC's infrastructure (AS15169). No SSL certificate was present, and the observed page title was 'Google'. Nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Google Safe Browsing did not flag the domain at the time of assessment.

Users who interacted with aethir.airdrpsalerts.cfd should immediately change any passwords entered on the site, particularly for Google accounts, and enable two-factor authentication (2FA) if not already active. Monitor accounts for unauthorized activity and report any suspected fraud to the impersonated brand (Google) and relevant authorities. To report the domain, submit it to platforms like Google Safe Browsing, PhishTank, or the registrar (Dynadot LLC) for further investigation.