airsdropalert[.]cfd

The domain airdropalert.cfd is a confirmed phishing site engaged in brand impersonation targeting Google. It presented itself as a legitimate Google service to deceive users into disclosing login credentials via email-based scams. No crypto drainer kit was identified. The site is currently taken offline, reducing immediate risk but not eliminating potential follow-on fraud.

Technical indicators show airdropalert.cfd was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar. It appeared on 4 security blocklists: PhishDestroy, Polkadot, Enkrypt, and Codeesura. The domain was registered through Dynadot LLC on November 05, 2025, and resolved to IP address 216.58.206.36, hosted on Google LLC infrastructure in Germany (AS15169). The SSL certificate was issued by WE2, and the observed page title was 'Google'. Gridinsoft assigned a trust score of 0 out of 100, consistent with malicious activity.

Users who interacted with airdropalert.cfd should immediately change any exposed Google account passwords and enable two-factor authentication. Monitor accounts for unauthorized activity, such as unfamiliar logins or transactions. Report the phishing domain to Google via their official reporting page and to local cybersecurity authorities or anti-phishing organizations like APWG. If financial or crypto accounts were accessed, contact the respective platforms to secure accounts and review recent transactions.