akt[.]airdropsalert[.]xyz

The domain akt.airdropsalert.xyz is a phishing site engaged in brand impersonation, specifically targeting Google as part of a cryptocurrency scam. This site posed an elevated risk by mimicking Google’s branding to deceive users into divulging sensitive information or interacting with fraudulent cryptocurrency offers. As of the latest verification, akt.airdropsalert.xyz has been taken offline, though it previously operated without a known drainer kit.

Technical analysis reveals that akt.airdropsalert.xyz was flagged by 13 of 95 security vendors on VirusTotal, including ADMINUSLabs, ChainPatrol, and BitDefender. The domain was registered through Dynadot LLC on October 17, 2025, and resolved to the IP address 142.250.188.4, hosted on Google LLC’s infrastructure (AS15169). It appeared on one security blocklist, PhishDestroy, and had no SSL certificate. The observed page title was 'Google', reinforcing its impersonation of the legitimate brand. Nameservers were hosted on Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), and Gridinsoft assigned it a trust score of 0/100.

Users who interacted with akt.airdropsalert.xyz should take immediate steps to secure their accounts and assets. For cryptocurrency-related scams, revoke any token approvals granted to suspicious sites and transfer funds to a new wallet. If login credentials were entered, change passwords for the affected accounts and enable two-factor authentication (2FA). Monitor accounts for unauthorized activity and report the phishing domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in mitigation efforts.