akt[.]airdropsalert[.]life

The domain akt.airdropsalert.life was registered through Dynadot LLC on 17 October 2025. It resolves to the IPv4 address 199.59.243.228, which is hosted in the United States under ASN 16509 belonging to Amazon.com, Inc. The site currently returns no SSL certificate, indicating that it served traffic over plain HTTP only. Google Safe Browsing classifies the URL as a social‑engineering threat, and the page title observed during the brief crawl was “airdropsalert.life”, matching the domain’s secondary label. Automated analysis linked the site to the publicly available “Airdrop Scam” phishing kit, and the payload was categorized as a crypto‑drainer, consistent with the “Crypto Scam” tag in the intelligence feed.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal reports that fifteen of ninety‑five scanning engines flagged the domain as malicious, providing additional independent confirmation of its hostile nature. At the time of this report (23 July 2026) the host appears to be taken offline, but the infrastructure components—namely the Amazon‑hosted IP and the registrar—remain active and could be reused for future campaigns. Defenders should continue to monitor the IP address 199.59.243.228 for any re‑activation, enforce outbound filtering to block HTTP traffic to the domain, and update proxy and DNS threat feeds with the observed indicators.

Because the site lacked TLS, any residual traffic would be observable in clear‑text logs, allowing detection of attempted connections. Further investigation of the Airdrop Scam kit version used here may reveal additional command‑and‑control URLs or cryptocurrency wallet addresses that can be added to blocklists. Until the domain is permanently retired, security teams should treat any future resolution of the domain or its IP as malicious.