arb[.]airsdropsalert[.]cfd

This domain, arb.airsdropsalert.cfd, is flagged as a brand impersonation threat targeting Gmail users. Analysis indicates the infrastructure was designed to mimic Google’s login interface, as evidenced by the page title 'Google' and the use of an SSL certificate issued by Google Trust Services (WE1). No direct evidence of a crypto drainer kit was observed, but the domain’s design aligns with credential theft campaigns aimed at harvesting user account details. The threat actor likely sought to exploit trust in the Gmail brand to deceive victims into entering sensitive information. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 142.250.81.228, which is geolocated in the United States under AS15169 (Google LLC). The domain was registered on November 05, 2025, through Dynadot LLC, a registrar frequently observed in malicious campaigns. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate, though issued by a legitimate provider, does not mitigate the domain’s fraudulent intent. No Google Safe Browsing (GSB) detection was noted at the time of analysis, suggesting the domain may have evaded initial detection mechanisms. The domain is currently offline, having been taken down following detection. However, residual risk remains due to the potential for infrastructure reuse or re-registration under a similar name. Users who may have interacted with the domain are advised to reset their Gmail credentials immediately and enable multi-factor authentication. Organizations should monitor for related indicators of compromise, including the IP address and SSL certificate thumbprint, to prevent further exploitation. The elevated risk level is justified by the domain’s targeted impersonation of a high-value brand and its prior operational status.