sym[.]app-airdropalert[.]lat

Analysis of the domain sym.app-airdropalert.lat indicates a confirmed brand impersonation campaign targeting Google, classified as an elevated-risk crypto scam. The domain was registered on November 10, 2025, through Dynadot LLC and configured with Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com). Infrastructure analysis reveals resolution to the IP address 142.250.181.228, geolocated to the United States under AS15169 (Google LLC), though this does not confirm hosting by Google itself. No SSL certificate was detected at the time of assessment.

Detection data shows the domain was flagged by 11 of 95 security vendors on VirusTotal, indicating moderate but not universal recognition of malicious activity. Gridinsoft assigned a trust score of 0/100, and the domain appears on at least one security blocklist, including a confirmed block by PhishDestroy. The page title, as reported, is 'Google,' aligning with the identified brand impersonation. The scam type is explicitly categorized as a crypto scam, though specific tactics (e.g., fake airdrops, wallet drainers) remain unconfirmed due to the lack of available page content analysis.

As of July 24, 2026, the domain is offline, reducing immediate risk to end users. However, defenders should treat this infrastructure as compromised and monitor for reactivation or migration to new domains under the same registrar or nameserver patterns. Network-level blocking of the IP 142.250.181.228 may provide additional mitigation, though collateral impact should be assessed due to its association with a major cloud provider. Organizations are advised to cross-reference this domain with internal logs for prior connections and update detection rules to account for similar impersonation patterns targeting Google or crypto-related lures.