eth[.]app-airdropalert[.]lat

Analysis of the domain eth.app-airdropalert.lat shows a short‑lived infrastructure that was taken offline as of the report date, July 23, 2026. The domain was created on November 10, 2025 and registered through Dynadot LLC. DNS resolution points to IP address 142.250.65.228, which is owned by Google LLC (AS15169) and geolocated to the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No SSL certificate was observed for the host, meaning HTTPS connections were unavailable. The page title returned by the server was simply "Google", and the site was classified as impersonating Google in a crypto‑scam context.

VirusTotal analysis recorded 14 detections out of 95 security vendors, demonstrating moderate vendor consensus on the malicious nature of the domain. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy feed. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of a highly untrusted resource. While the available data confirms the domain’s malicious intent, several aspects remain unclear: the exact payload delivered, any hosting of malicious binaries, and the presence of additional URLs sharing the same infrastructure.

Defenders should immediately block the domain at perimeter firewalls and DNS filtering solutions, add it to internal blocklists, and monitor for any DNS lookups to the associated IP address or Cloudflare nameservers. Continuous observation of related registrars, especially Dynadot, and similar naming patterns (e.g., *.airdropalert.lat) is advised to detect potential re‑use. Given the lack of HTTPS, any future re‑activation would be detectable via HTTP status monitoring. The combination of vendor detections, blocklist inclusion, low trust score, and confirmed brand impersonation warrants an elevated risk posture for any assets that might encounter this domain.