stellar[.]airsdropsalert[.]cfd

The domain stellar.airsdropsalert.cfd is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page to deceive users into entering sensitive credentials, constituting a credential phishing scam. No crypto drainer kit was detected. As of the latest verification, stellar.airsdropsalert.cfd has been taken offline.

Technical indicators confirm the malicious nature of stellar.airsdropsalert.cfd. The domain was flagged by 3 of 95 security vendors on VirusTotal, including ChainPatrol, CRDF, and SOCRadar. It appears on 1 security blocklist (PhishDestroy) but is not flagged by Google Safe Browsing. Registered through Dynadot LLC on November 05, 2025, the domain resolves to the IP address 142.250.74.196, hosted on Google LLC's infrastructure (AS15169). The SSL certificate is issued by Google Trust Services / WE1, and the observed page title is 'Google'. Technologies detected include Bootstrap, jQuery, Cloudflare Browser Insights, and Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com). The site returned an HTTP 523 status before being taken offline.

Users who may have interacted with stellar.airsdropsalert.cfd should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) on all critical services to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google’s abuse reporting tool and to platforms like PhishTank or the Anti-Phishing Working Group (APWG) to aid in broader takedown efforts.