vvv[.]airdropsalert[.]bar

On July 23, 2026, the domain vvv.airdropsalert.bar was identified as an active component of a Google‑focused brand‑impersonation campaign that leverages a crypto‑scam narrative. The domain was registered through Dynadot LLC on 20 October 2025 and is hosted on an IPv6 address (2a00:1450:4001:80f::2004) that belongs to AS15169, which is owned by Google LLC and geolocated in Germany. The use of Google’s own address space suggests an attempt to increase perceived legitimacy. DNS resolution is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and no TLS certificate was observed, meaning the site was served over plain HTTP. The page title returned by the server is “Google”, aligning with the declared brand target.

VirusTotal analysis recorded 16 detections out of 95 scanning engines, indicating a moderate level of consensus among security vendors that the domain is malicious. The domain appears on a single public blocklist and is explicitly listed by the PhishDestroy blocklist, confirming that at least one anti‑phishing service has taken action. Current monitoring shows the site is offline, which may be the result of takedown efforts or temporary suspension. Defenders should immediately add vvv.airdropsalert.bar to outbound filtering rules and ensure that any internal DNS resolvers block resolution to the associated IPv6 address.

Because the domain uses Cloudflare’s infrastructure, other malicious actors could potentially register similar sub‑domains; therefore, broader controls that block traffic to newly created sub‑domains under airdropsalert.bar are advisable. Continuous observation of Dynadot‑registered domains that resolve to AS15169 addresses is recommended, as this pattern may be reused.