usual[.]airdrpsalerts[.]cfd

The domain usual.airdrpsalerts.cfd is a phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google service to deceive users into disclosing sensitive information, such as login credentials. No crypto drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk, but its prior activity warrants caution for those who may have interacted with it.

Technical indicators confirm the domain's malicious nature. As of analysis, 2 of 95 VirusTotal security vendors flagged usual.airdrpsalerts.cfd, including ChainPatrol and SOCRadar. The domain was registered through Dynadot LLC on October 29, 2025, and resolves to the IPv6 address 2607:f8b0:4004:c07::93, hosted on Google LLC's infrastructure (AS15169). It appears on one security blocklist, PhishDestroy, and lacks an SSL certificate. The observed page title was 'Google', reinforcing its impersonation of the legitimate brand. Nameservers are hosted on Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com).

Users who visited usual.airdrpsalerts.cfd should take immediate action to secure their accounts. If login credentials were entered, change passwords for the affected Google account and any other services where the same credentials may have been reused. Enable two-factor authentication (2FA) to add an extra layer of security. Monitor the account for unauthorized activity, such as unfamiliar logins or changes to settings. Report the phishing domain to Google's abuse team via their reporting portal and to platforms like PhishTank or the Anti-Phishing Working Group to aid in broader mitigation efforts.