akt[.]airsdropsalert[.]cfd

The domain akt.airsdropsalert.cfd has been identified as a phishing resource specializing in brand impersonation, specifically targeting Gmail users. Analysis confirms the domain is currently offline, though prior activity involved presenting a fraudulent login interface mimicking Google’s authentication portal. The page title displayed to victims was 'Google,' reinforcing the deceptive intent to harvest credentials under false pretenses. Infrastructure analysis reveals the domain was registered through Dynadot LLC on November 05, 2025, and resolved to the IP address 172.253.63.99, which is associated with AS15169 (Google LLC). Detection metrics indicate the domain was flagged by 14 of 95 security vendors on VirusTotal, while appearing on one security blocklist. The SSL certificate was issued by Google Trust Services (WE1), further complicating detection by blending with legitimate infrastructure. Creation date anomalies and registrar selection suggest an attempt to evade automated takedown mechanisms. Current status confirms the domain has been taken offline, though residual risk remains due to the potential for re-registration or migration to alternative infrastructure. Organizations and users are advised to monitor for similar domains registered under Dynadot LLC or resolving to Google LLC IPs, particularly those created within the same timeframe. Immediate actions include blocking the domain and IP at the network perimeter, updating endpoint detection rules to flag similar SSL certificates, and conducting retrospective log analysis for connections to 172.253.63.99. Users who may have interacted with the domain should initiate password resets and enable multi-factor authentication on all associated accounts.