akt[.]airdropsalert[.]app

This domain, akt.airdropsalert.app, is confirmed as a high-risk brand impersonation site targeting Google. Analysis indicates the infrastructure was designed to mimic Google's legitimate services, likely for credential theft or account compromise. The page title explicitly displays 'Google,' reinforcing the intent to deceive users into believing they are interacting with an official Google property. No evidence of crypto drainer functionality was observed in available telemetry, though credential harvesting remains the primary threat vector. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolved to the IPv6 address 2607:f8b0:4004:c1d::6a, geolocated within Google LLC's AS15169 network. VirusTotal detection metrics show 16 out of 95 security vendors flagging the domain as malicious. Google Safe Browsing classified the site as phishing, and it appears on at least one security blocklist (PhishDestroy). Notably, the domain lacked an SSL certificate, which is atypical for legitimate services and further indicates malicious intent. No creation date was provided in available data, but the rapid takedown suggests recent deployment. The domain is currently offline, likely following detection and enforcement actions. However, residual risk persists due to the potential for infrastructure reuse or migration to new domains. Users who interacted with the site should assume credential exposure and initiate password resets for associated accounts. Organizations are advised to monitor for similar impersonation attempts, particularly those leveraging Cloudflare registrations or Google-hosted IPs to evade detection. Blocking the domain and associated IP at the network level is recommended as a preventive measure.