draketake[.]com

Analysis of draketake.com, observed on 23 July 2026, indicates that the domain is currently offline but previously hosted malicious content that impersonated Google. The site resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate was presented, meaning the site operated over plain HTTP. The HTML title retrieved from the site read “Téléchargez Google Chrome, le navigateur plus sécurisé et encore plus rapide de Google”, directly referencing Google Chrome and aligning with the declared brand target of Google.

Registration data shows the domain was created on 21 February 2026 and was registered through NiceNIC International Group Co., Limited, with Cloudflare nameservers armando.ns.cloudflare.com and ruth.ns.cloudflare.com. Reputation services assign very low trust scores: Scamadviser rates the domain 11/100 and Gridinsoft 1/100, reflecting a high likelihood of abuse. VirusTotal analysis returned 14 positive detections out of 95 scanned engines, confirming that multiple security vendors consider the domain malicious. The domain is listed on at least one public blocklist and has been explicitly blocked by the PhishDestroy filtering service.

Although the site is no longer reachable, the combination of brand impersonation, low trust scores, multiple vendor detections, and blocklist presence suggests a continued risk to users who might encounter the URL in phishing campaigns or malicious email links. Defenders should add draketake.com to URL and DNS blocklists, monitor for any re‑hosting attempts on other IP ranges, and enforce strict safe‑browsing policies for any Google‑related download prompts that originate from non‑official domains. Further investigation of associated infrastructure, such as other domains using the same Cloudflare nameservers or similar registration patterns, is recommended to uncover any residual campaign components.