hydration[.]app-airdropalert[.]lat

Analysis of hydration.app-airdropalert.lat shows a newly registered domain (creation date November 10, 2025) that is actively impersonating Google, as indicated by the page title "Google" and the explicit brand target flag. The domain is registered through Dynadot LLC and uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a common configuration for fast‑flux or disposable hosting. DNS resolution points to IP address 142.250.185.196, which belongs to AS15169 Google LLC and is located in the United States. Although the IP ownership aligns with the victim brand, the use of a Google‑owned address for a malicious site is a known evasion technique that can lend false credibility to the payload.

No SSL certificate is present, meaning the site would have been served over HTTP, which is atypical for legitimate Google services that enforce HTTPS. The site was identified as a crypto‑scam type and has been blocked by PhishDestroy. It appears on one public security blocklist and has a Gridinsoft trust score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal analysis shows 13 of 95 scanned security vendors flagging the domain, providing additional corroboration of its risk profile.

Current status is offline, but the infrastructure components (registrar, nameservers, hosting IP) remain observable and could be re‑activated. Defenders should add hydration.app-airdropalert.lat to URL filtering and DNS blocklists, monitor for any re‑registration or changes to the hosting IP, and treat any future HTTP requests to this domain as hostile. Because the site’s content has not been captured, the exact nature of the crypto‑scam (e.g., wallet draining, fraudulent airdrop promises) remains uncertain; however, the combination of brand impersonation, lack of TLS, low trust score, and multi‑vendor detection warrants an elevated risk rating and proactive mitigation.