cetus[.]app-airdropalert[.]cfd

The domain cetus.app-airdropalert.cfd has been identified as engaging in brand impersonation, specifically targeting the Gmail brand by presenting a fake login page titled "Google." This domain is currently offline, having been taken down after security researchers flagged it as a phishing threat. The impersonation of Gmail is a common tactic used to steal user credentials, and this domain was part of a broader campaign to deceive users into entering sensitive information.

According to threat intelligence data, cetus.app-airdropalert.cfd resolves to the IP address 142.250.185.164 and was registered through Dynadot LLC on November 10, 2025. The domain was flagged by 11 out of 95 security vendors on VirusTotal, indicating a significant level of malicious consensus. It appears on one security blocklist and lacks an SSL certificate, which further underscores its fraudulent nature. The unique seed 905efc was assigned to this analysis to ensure distinct reporting.

As of the latest check, the domain remains offline, which is a positive outcome. However, users should remain vigilant against similar domains that may attempt to impersonate Gmail or other trusted brands. PhishDestroy recommends avoiding interaction with any unsolicited login pages and always verifying the URL before entering credentials. If you encounter suspicious domains, report them to security teams and use multi-factor authentication to protect your accounts.