degen[.]airdropsalert[.]bar

Analysis indicates that degen.airdropsalert.bar is an offline domain that was registered on October 20, 2025 through Dynadot LLC. The domain resolves to IP 142.250.186.164, which belongs to AS15169 Google LLC located in the United States. Despite pointing to a Google‑owned address, the site presents a page title of “Google” and is classified as a brand‑impersonation attempt targeting Google users. The absence of an SSL certificate means the site operated without HTTPS, a common trait of fraudulent pages. VirusTotal records show that 16 of 95 scanning engines flagged the domain, demonstrating a moderate to high detection rate among security vendors.

Google Safe Browsing has labeled the site as a social‑engineering threat, reinforcing the impersonation assessment. Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com host the domain, indicating the use of a reputable DNS provider to obscure the true infrastructure. The site is listed on a single security blocklist and has been actively blocked by PhishDestroy, suggesting that at least one anti‑phishing service has taken mitigation steps. Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely low reputation.

The listed scam type is “Crypto Scam,” implying that the impersonated brand may have been used to lure victims into cryptocurrency‑related fraud. Defenders should continue to enforce DNS‑level blocks for the domain, monitor for any re‑hosting attempts, and consider the associated IP address as high‑risk despite its legitimate ownership. Endpoint protection solutions should treat any traffic to this host as malicious, and email filters should flag messages referencing degen.airdropsalert.bar. Ongoing observation of Cloudflare name server activity and the registrar Dynadot may reveal future campaigns employing similar tactics.