threshold[.]app-airdropalert[.]lat

Analysis of threshold.app-airdropalert.lat, first observed on November 10 2025, shows a short‑lived infrastructure that was taken offline before the July 23 2026 reporting date. The domain is registered through Dynadot LLC and resolves to the IP address 142.251.40.132, which belongs to AS15169 Google LLC and is located in the United States. Despite pointing to an IP range owned by Google, the host presents no TLS certificate, indicating that any communication would occur over plain HTTP. The domain’s authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑operated, a pattern commonly seen in fast‑flux or disposable phishing deployments.

The page title returned by the server is “Google,” confirming the intended brand impersonation, and the campaign is classified as a crypto‑scam, likely attempting to lure victims with fraudulent airdrop promises. VirusTotal scans have flagged the domain in 15 of 95 security engines, and the domain is listed on a single external blocklist. It has also been blocked by the PhishDestroy service. Independent trust scoring services rate the site at 0 out of 100, reinforcing the malicious assessment.

The limited detection footprint suggests that the site was active for a brief window, reducing the probability of widespread victimization but not eliminating the risk to users who may have accessed it before takedown. Defenders should continue to block the domain at DNS and proxy layers, monitor for any residual activity on the associated IP address, and ensure that threat‑intel feeds are updated with the domain’s indicators of compromise. Because the domain is offline, verification of the landing page content is not possible, and further analysis would rely on archived snapshots or network captures, if available.