metis[.]app-airdropalert[.]lat

This investigation documents the infrastructure associated with metis.app-airdropalert.lat, a domain observed conducting brand impersonation targeting Google. The domain was registered on 10 November 2025 through Dynadot LLC and is currently hosted on an IP address owned by Google (AS15169) located in the United States, specifically 142.250.185.132. DNS resolution is delegated to Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and possibly its protective edge services. No TLS certificate was presented when the site was queried, meaning the connection was served over plain HTTP, which is consistent with many short‑lived phishing deployments that forego HTTPS to reduce setup time. Static analysis of the page returned the title “Google,” reinforcing the intent to masquerade as an official Google service.

The site was classified as a crypto‑related scam in the source intelligence, though the exact payload or lure has not been captured. VirusTotal scans recorded detections from 13 of 95 antivirus and URL‑reputation engines, providing modest but meaningful corroboration of malicious intent. The domain appears on a single external blocklist and has been flagged by the PhishDestroy sinkhole, confirming that community‑based defenses have already taken action. At the time of reporting (23 July 2026) the domain is offline, which may reflect takedown efforts or the operators’ own shutdown schedule. Nevertheless, the combination of a recent registration, use of a high‑reputation IP space, Cloudflare DNS, lack of TLS, and multiple vendor detections suggests a deliberate attempt to exploit brand trust for cryptocurrency fraud.

Open questions remain regarding the specific phishing page content, any credential‑harvesting forms, and whether the domain was part of a larger campaign sharing the same naming pattern. Defenders should continue to monitor the domain and its associated IP address for any re‑activation.