polymarket[.]app-airdropalert[.]lat

polymarket.app-airdropalert.lat is a newly registered domain (created 10 November 2025) that resolves to IP 142.251.167.106, which belongs to Google’s AS15169 network in the United States. The domain is registered through Dynadot LLC and uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, indicating the site is served over plain HTTP. The page title returned from the host is “Google,” matching the declared brand target and confirming a Google impersonation attempt. VirusTotal scans flagged the domain in 13 of 95 engines, and the site appears on at least one external security blocklist.

PhishDestroy has taken the domain offline, and current status reports confirm it is no longer reachable. The limited artifact set points to a crypto‑related scam, as indicated by the “Crypto Scam” classification in the intelligence feed. The use of a Google‑related page title and the brand‑target field suggest an attempt to lure victims into providing credential or wallet information under the guise of a Google service. However, the exact content of the landing page has not been captured, so the specific lures, malicious payloads, or credential‑harvesting mechanisms remain unknown. Defenders should add 142.251.167.106 to network‑level blocklists for the duration of the investigation, even though the IP belongs to Google, to prevent collateral traffic to the malicious host.

Domain‑level filtering should block all subdomains of *.airdropalert.lat and the full hostname polymarket.app-airdropalert.lat. Monitoring for new registrations that combine “polymarket”, “airdropalert”, or similar phishing keywords with reputable brand names is recommended. Because the infrastructure uses Cloudflare DNS, future campaigns may switch to different IPs while retaining the same nameserver configuration; thus, real‑time DNS and passive DNS monitoring is advisable.