beefy[.]airdropsalert[.]bar

The domain beefy.airdropsalert.bar is observed to be an active brand‑impersonation campaign targeting Google users. Registration data shows the domain was created on 20 October 2025 through Dynadot LLC, and DNS resolution points to IP address 142.250.185.68, which belongs to AS15169 Google LLC located in the United States. The domain resolves via Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate is presented, leaving the site unencrypted. The page title returned by the server is "Google", matching the declared brand target and confirming the impersonation intent. The campaign is classified as a crypto scam, and Google Safe Browsing has flagged the domain for social‑engineering activity.

Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of credibility. VirusTotal analysis shows that 13 of 95 scanning engines have reported the domain as malicious, and it appears on at least one external security blocklist. PhishDestroy also lists the domain as blocked. The domain is currently taken offline, which may be a temporary takedown or a shift to a new hosting location; its future status cannot be confirmed without further monitoring. Defenders should block network resolution to 142.250.185.68 and add beefy.airdropsalert.bar to host‑based and DNS‑based deny lists.

Continuous monitoring of the associated Cloudflare nameservers and any re‑registration attempts is recommended, as the actors may reuse the same branding on a new domain. Incident response teams should treat any traffic to this domain as potentially malicious, especially any attempts to deliver cryptocurrency‑related payloads or request wallet credentials. Because the site lacks TLS, any data submitted would be transmitted in clear text, increasing exposure risk. Until the domain is definitively decommissioned, organizations should maintain the block and alert on any user‑initiated connections.