astr[.]airsdropsalert[.]cfd

The domain astr.airsdropsalert.cfd has been identified as a brand impersonation threat targeting Gmail users. This phishing site was designed to mimic the Google login page, tricking visitors into entering their credentials. The site's page title was simply "Google," furthering the deception. No specific drainer kit was identified, but the intent was clearly credential theft.

Technical indicators reveal that the domain was created on November 05, 2025, and registered through Dynadot LLC. It resolves to IP address 2a00:1450:4001:81c::2004 and uses an SSL certificate from Google Trust Services (WE1). VirusTotal analysis shows 14 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. The domain is currently offline, meaning the phishing site is no longer accessible.

Despite being taken offline, the risk remains that similar domains may appear. Users should always verify URLs before entering credentials and use PhishDestroy to check for known threats. PhishDestroy recommends enabling two-factor authentication on Gmail accounts and reporting any suspicious login pages to Google. Stay vigilant against phishing attempts that impersonate trusted brands like Gmail.