defiapp[.]app-airdropalert[.]lat

The domain defiapp.app-airdropalert.lat was registered on 10 November 2025 through Dynadot LLC. DNS resolution points to the IP address 142.250.186.164, which belongs to AS15169 Google LLC in the United States. The hosting infrastructure therefore appears to be co‑located with legitimate Google services, a tactic often used to lend credibility to fraudulent sites. The domain lacks an SSL/TLS certificate, indicating that HTTPS connections are not available. Nameserver records are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑managed, suggesting the attacker leveraged Cloudflare’s DNS front‑end. Public scanning on VirusTotal returned 14 positive detections out of 95 vendors, confirming that multiple security products consider the host malicious.

Gridinsoft’s trust score is 0 / 100, and the domain appears on one external blocklist. PhishDestroy has already taken the site offline, and the current status is listed as offline. The page title returned by the web server is “Google”, matching the declared brand target of Google and the reported scam type of a crypto‑related airdrop lure. Analysis indicates the operator is attempting a brand‑impersonation campaign aimed at Google users, likely to harvest cryptocurrency wallet credentials or lure victims into sending funds under the pretense of an airdrop. The use of a Google‑owned IP range and Cloudflare nameservers may be intended to bypass casual inspection.

Uncertainty remains regarding the exact phishing kit, the content served before takedown, and whether additional subdomains exist. Defenders should block the domain and its associated IP at perimeter firewalls, update DNS sinkhole lists with the observed nameservers, and monitor for any re‑registration of the same second‑level domain or similar sub‑domains. Continuous threat‑intel feeds should be queried for new detections linked to the IP 142.250.186.164 or the registrar Dynadot.