degen[.]app-airdropalert[.]lat

Analysis as of July 23, 2026 indicates that the domain degen.app-airdropalert.lat is currently taken offline. The domain was registered on November 10, 2025 via Dynadot LLC and resolves to the IP address 142.250.185.100, which belongs to AS15169 Google LLC located in the United States. Although the IP is owned by Google, the domain itself does not present a valid TLS certificate, and the HTTP response is not available because the site is offline. The page title returned during the brief live period was “Google”, matching the declared brand target of Google. The infrastructure is associated with a crypto‑scam classification and has been flagged by 13 of 95 security vendors on VirusTotal.

Independent scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of malicious intent. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. Its authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both hosted by Cloudflare. The combination of brand impersonation, lack of SSL, low trust score, and multiple vendor detections supports an elevated risk rating. Uncertainty remains regarding the exact payload or phishing page content, as the site was taken offline before a full content capture could be completed.

No Safe Browsing or OTX entries are referenced in the available intelligence. Defenders should continue to deny any traffic to degen.app-airdropalert.lat at the DNS or proxy level, add the domain and its resolving IP to local blocklists, and monitor for any re‑appearance or reuse of the same IP range. Given the association with a crypto‑scam, alerts should be generated for any outbound connections from internal hosts to this domain, and security teams should verify that endpoint protection products are updated to reflect the 13 vendor detections. Ongoing observation of the Cloudflare name servers for new subdomains is also recommended.