akt[.]airdropsalert[.]bar

The domain akt.airdropsalert.bar was registered on October 20, 2025 through Dynadot LLC and is presently taken offline. Technical analysis shows it resolves to IP address 142.250.185.228, an address owned by AS15169 Google LLC in the United States, indicating the attacker leveraged a legitimate Google infrastructure IP to increase perceived trust. The site presented a page title of "Google," directly matching the targeted brand, and is classified as a crypto scam. No SSL certificate was observed, leaving the connection unencrypted and facilitating potential credential capture.

Detection data indicates that 14 of 95 security vendors on VirusTotal flagged the domain, while the site appears on a single external blocklist. Google Safe Browsing has listed the domain for social engineering, and PhishDestroy reports it as blocked. Reputation services are extremely low, with Scamadviser scoring 1 out of 100 and Gridinsoft assigning a score of 0 out of 100. Nameservers are hosted on Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com).

While the domain’s content beyond the page title has not been publicly reviewed, the combination of brand impersonation, crypto‑scam labeling, lack of TLS, and multiple vendor detections suggests a high‑confidence malicious indicator. Defenders should add the domain to internal blocklists, enforce DNS filtering against the resolved IP, monitor for any future re‑activation, and ensure users are educated about unsolicited communications referencing Google with crypto incentives. Continuous monitoring of Cloudflare name‑server changes and periodic re‑scanning via VirusTotal are recommended to capture any evolution of the threat infrastructure.