camp[.]airdropalerts[.]bar

camp.airdropalerts.bar was registered on 21 February 2026 through Dynadot LLC. The domain resolves to 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS resolution uses the Cloudflare name servers alexa.ns.cloudflare.com and randall.ns.cloudflare.com, indicating the infrastructure is hosted behind Cloudflare’s reverse‑proxy network. No TLS certificate was presented during connection attempts, confirming that the site operates without HTTPS encryption. The site’s HTML title tag contains the text “Camp Network”, but no additional branding or target victim information is disclosed in the available data.

The domain has been classified as a crypto‑drainer scam; four of ninety‑five VirusTotal scanners flagged the host as malicious, and it appears on a single external blocklist. Gridinsoft’s reputation engine rates the domain at 0 out of 100, reflecting an extremely low trust score. PhishDestroy has already taken the domain offline, and the current status is recorded as “taken offline”. Evidence suggests the threat actor leveraged a cheap, rapidly‑created domain and Cloudflare’s anonymizing services to host a cryptocurrency siphoning page, likely intended to lure users into connecting wallets or authorizing transactions.

Because the site is already offline, immediate mitigation focuses on preventing future use of the same IP address range or Cloudflare‑proxied assets. Defensive teams should add 188.114.96.3 to network deny lists, enforce DNS filtering for the domain, and monitor for newly registered domains that resolve to Cloudflare IP blocks and lack TLS. Continuous observation of PhishDestroy and other blocklist feeds is recommended to capture any re‑deployment attempts. Organizations should also educate users about unsolicited crypto‑drain requests and advise against signing any transaction without verifying the source.