aethir[.]app-airdropalert[.]lat

Analysis of aethir.app-airdropalert.lat indicates that the site was employed in a brand‑impersonation campaign targeting Google. The domain was registered on November 10, 2025 through Dynadot LLC and is serviced by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution maps the domain to IP address 142.250.65.228, which belongs to AS15169 Google LLC and is geolocated to the United States. No TLS certificate was presented, meaning the site operated without HTTPS protection. The page title returned by the HTTP response is the generic string “Google”, matching the declared brand target.

Threat intelligence classifies the activity as a crypto‑scam, and 13 of 95 security vendors on VirusTotal flagged the domain as malicious. Additional trust metrics are extremely low, with Gridinsoft assigning a score of 0 / 100 and Scamadviser a score of 1 / 100. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service. Current observations show the domain is offline, and its status is recorded as taken offline as of the report date, July 23 2026.

The combination of a newly created domain, lack of TLS, low trust scores, and multiple vendor detections suggests a high probability of malicious intent. Defenders should continue to block the domain at perimeter filters, ensure any residual DNS entries are scrubbed, and monitor for related indicators such as the associated IP address and Cloudflare nameservers. Threat hunting should include searches for traffic to 142.250.65.228 and any attempts to resolve aethir.app-airdropalert.lat, especially in contexts involving Google‑related credentials or cryptocurrency transactions. Since the site is already offline, no immediate remediation of compromised content is required, but continued surveillance is advised to detect possible re‑use of the infrastructure.