usual[.]airsdropsalert[.]cfd

This domain, usual.airsdropsalert.cfd, is identified as a brand impersonation threat targeting Gmail, a widely used email service. Analysis indicates the domain was designed to mimic the official Gmail login interface, as evidenced by the page title 'Google' and the use of an SSL certificate issued by Google Trust Services. No direct evidence of a crypto drainer or credential harvester script was observed, but the infrastructure aligns with phishing campaigns aimed at credential theft through fake login portals.

Technical indicators reveal the domain was registered on November 05, 2025, through Dynadot LLC. It resolves to the IP address 142.250.186.36, which is associated with legitimate Google infrastructure, likely an attempt to evade detection. The domain appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal. No Google Safe Browsing (GSB) listing was recorded at the time of analysis, though this may reflect the domain's recent takedown rather than prior inaction.

As of the latest verification, usual.airsdropsalert.cfd has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure remains registered, and similar campaigns may re-emerge using comparable tactics. Organizations and users are advised to block the domain at the network level, monitor for related indicators of compromise, and verify SSL certificates when accessing sensitive login pages. Remaining risk is classified as elevated due to the potential for infrastructure reuse or copycat attacks.