folks[.]airdropsalert[.]bar

The domain folks.airdropsalert.bar was flagged as a high‑risk brand‑impersonation infrastructure targeting Google. The site was registered through Dynadot LLC on 20 October 2025 and resolves to the IP address 142.250.80.100, which belongs to AS15169 Google LLC in the United States. Despite the IP belonging to Google’s network, the domain is not covered by a valid TLS certificate; no SSL certificate was observed. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating use of Cloudflare DNS services. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on a single security blocklist.

PhishDestroy has actively blocked the domain, and the broader security community has recorded 15 detections out of 95 vendors on VirusTotal. Scamadviser assigns a trust score of 1 / 100 and Gridinsoft a score of 0 / 100, reinforcing the malicious reputation. The page title returned by the server is “Google”, matching the declared brand target. The listed scam type is “Crypto Scam”, suggesting the infrastructure may have been used to lure victims into cryptocurrency‑related fraud.

At the time of analysis the site is offline, and no further content was retrieved, leaving the exact phishing payload unknown. The lack of HTTPS and the minimal public footprint limit current technical attribution, but the convergence of multiple independent detections, the brand‑impersonation indicator, and the low trust scores justify a high‑risk rating. Defenders should block the domain at perimeter and DNS layers, monitor for any re‑appearance of the host on the same IP or similar Cloudflare name‑server configuration, and include the domain in threat‑intel feeds. Ongoing observation of the IP range owned by AS15169 for new suspicious registrations is also recommended.