tia[.]airdropsalert[.]bar

Analysis of tia.airdropsalert.bar shows a brand‑impersonation infrastructure targeting Google users. The domain was registered through Dynadot LLC on 20 Oct 2025 and is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, indicating HTTP‑only delivery. DNS resolution points to the IPv6 address 2607:f8b0:4004:c25::93, which belongs to AS15169 (Google LLC) in the United States, a common tactic to lend legitimacy to malicious sites. The page title returned by the server is "Google", matching the declared brand target and confirming the impersonation claim.

The site is classified as a crypto‑scam, though the specific payload or monetary demand has not been captured in the available data. Multiple security products have flagged the domain; 16 of 95 VirusTotal scanners raise detections, and Gridinsoft assigns a trust score of 0 / 100. PhishDestroy has already taken the domain offline, and it appears on one public blocklist. The lack of an SSL certificate and the offline HTTP status reduce immediate exposure, yet the underlying infrastructure—particularly the use of a Google‑owned IP range—could be reused for future campaigns.

Uncertainty remains around the exact phishing kit, the content served before takedown, and any associated command‑and‑control endpoints, as no further artifacts have been disclosed. Defenders should continue to block the domain and its associated IPv6 address at network perimeters, enforce strict outbound filtering for unauthenticated HTTP traffic, and monitor for re‑registration attempts of similar subdomains under the same registrar. Threat‑intel feeds should be updated to reflect the crypto‑scam classification, and any detection signatures that rely on the observed page title or Cloudflare nameserver pattern should be propagated.