prontikot[.]com

This domain, prontikot.com, is identified as a high-risk brand impersonation threat targeting Google users. Analysis indicates the site is designed to mimic legitimate Google login pages, likely to harvest user credentials or deploy additional malicious payloads. The threat type is classified as credential phishing, with no evidence of a drainer kit at this time, though further forensic analysis of the page source would be required to confirm absence definitively. Infrastructure analysis reveals the domain was registered on April 20, 2026, through Web Commerce Communications Limited dba WebNic.cc. It resolves to the IP address 104.21.10.213, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain is flagged by 20 out of 95 security vendors on VirusTotal, and Google Safe Browsing explicitly marks it as phishing. It appears on one security blocklist, and its SSL certificate is issued by Let's Encrypt (serial number YE2). The page title, 'Attention Required! | Cloudflare,' suggests an attempt to bypass automated security checks or mislead users into disabling protections. As of the latest verification, prontikot.com has been taken offline, likely due to enforcement actions by the hosting provider or registrar. However, the domain remains registered, posing a residual risk of reactivation or migration to alternative infrastructure. Organizations are advised to block the domain and its associated IP (104.21.10.213) at the perimeter, monitor for related subdomains or newly registered lookalike domains, and alert users to the specific threat of Google credential phishing. Security teams should review logs for connections to the domain or IP prior to takedown to assess potential compromise.