bnc[.]airdropsalert[.]cfd

This domain operates as a credential harvesting portal targeting users of Google services. The site presents a fraudulent login interface mimicking Google’s authentication page, designed to capture usernames and passwords entered by unsuspecting visitors. Analysis of the page title confirms the impersonation attempt, as it displays 'Google' despite not being affiliated with the legitimate service. Such infrastructure is commonly deployed in phishing campaigns to facilitate account takeovers, data exfiltration, or subsequent malicious activities like spam distribution or financial fraud. Infrastructure analysis reveals the domain was registered on October 01, 2025, through Dynadot LLC, a registrar frequently used for short-lived malicious domains. The domain resolves to the IP address 216.58.206.36, which is associated with hosting environments often exploited for phishing operations. Security telemetry indicates that 5 out of 95 antivirus and threat detection engines on VirusTotal have flagged this domain as malicious, while it also appears on one security blocklist. The combination of recent registration, brand impersonation, and detection by multiple security vendors underscores the elevated risk posed by this infrastructure. Users who visited bnc.airdropsalert.cfd should immediately take corrective actions to mitigate potential compromise. First, reset the password for any Google account accessed through the site, using a strong, unique passphrase and enabling multi-factor authentication. Review account activity for unauthorized logins or changes, particularly in security settings, connected apps, or recovery options. If financial or sensitive data was entered, monitor associated accounts for suspicious transactions and consider placing a fraud alert with relevant institutions. Finally, scan the device used to access the domain for malware, as phishing sites may deploy additional payloads to maintain persistence or exfiltrate data.