wlfi[.]app-airdropalert[.]lat

The domain wlfi.app-airdropalert.lat was observed in a brand‑impersonation campaign targeting Google. The site presented the static page title “Google” but offered no HTTPS certificate, indicating an unencrypted HTTP service. DNS resolution returned the IP address 142.250.181.228, which belongs to AS15169 Google LLC and is located in the United States, suggesting the adversary leveraged a legitimate Google range to host the malicious payload. The domain was registered on 10 Nov 2025 through Dynadot LLC and uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

Reputation scoring is extremely low; Gridinsoft assigned a trust score of 0 / 100. VirusTotal analysis recorded 11 detections out of 95 scanned vendors, confirming that multiple security products flag the domain as malicious. The threat is classified as a crypto‑scam, and the site impersonates Google, likely to lure victims into fraudulent airdrop or token‑distribution schemes. The domain has been taken offline at the time of reporting and is currently listed on at least one public blocklist, with PhishDestroy confirming the block.

Defenders should immediately add wlfi.app-airdropalert.lat to URL filtering and firewall deny lists, monitor for any resurgence of the domain or its sub‑domains, and consider issuing a DNS sink‑hole rule for the associated IP range. Although the IP resides within a Google‑owned block, the absence of TLS and the low trust score indicate no legitimate service. Continuous telemetry from DNS logging and outbound traffic inspection is recommended to detect any residual contact attempts. Incident response teams should also verify whether any victims have been exposed to credential‑phishing or crypto‑wallet compromise tied to this indicator and advise users to avoid interacting with any URLs containing the “app‑airdropalert.lat” suffix.