usual[.]app-airdropalert[.]lat

Analysis of usual.app-airdropalert.lat indicates a brand-impersonation domain targeting Google, classified as a crypto scam. The domain was registered on November 10, 2025, through Dynadot LLC and has since been taken offline. Infrastructure analysis reveals it resolved to IP 142.250.185.132, which is geolocated in the US under AS15169 (Google LLC). This association with Google's network infrastructure is notable, though it does not confirm legitimacy, as threat actors occasionally exploit hosting environments linked to the brands they impersonate. The domain was flagged by 14 of 95 security vendors on VirusTotal, and it appears on at least one blocklist (PhishDestroy).

Gridinsoft assigned a trust score of 0/100, further indicating malicious intent. No SSL certificate was detected, which is atypical for legitimate services and increases exposure to interception or tampering. Nameservers point to Cloudflare (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common practice among both legitimate and malicious domains to obfuscate hosting origins. The page title was recorded as 'Google,' aligning with the reported brand impersonation. However, the exact content and mechanics of the scam remain unconfirmed, as the site is offline and no forensic artifacts are available for deeper analysis.

The scam type is categorized as 'crypto scam,' though specific tactics—such as fake airdrops, wallet drainers, or fraudulent investment schemes—are not detailed in the available intelligence. Defenders should treat this domain as high-risk due to its confirmed blocklist presence, low trust scores, and brand-impersonation context. Network security teams are advised to block the domain and its resolved IP at perimeter defenses. SOC analysts should review logs for connections to 142.250.185.132 or DNS queries to usual.app-airdropalert.lat, particularly in environments where crypto-related activity is prohibited.