get-bag[.]fun
“TOKEN_NAME | Airdrop”
साक्ष्य सारांश
The domain get-bag.fun was registered on 2026-02-01 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on the Cloudflare network (AS13335) with the IPv4 address 172.67.173.95 located in the United States. The authoritative nameservers are ns1.suspended-domain.com and ns2.suspended-domain.com. No TLS certificate was presented at the time of observation, indicating the site was served over plain HTTP. Gridinsoft assigned a trust score of 0 / 100, and the site appears on a single external security blocklist. PhishDestroy has also listed the domain as blocked.
VirusTotal analysis shows that 10 of 93 scanned security vendors flagged the domain, confirming malicious behavior. The page title returned by the server is “TOKEN_NAME | Airdrop”, and the underlying phishing kit has been identified as the “Airdrop Scam” kit. The campaign is classified as credential phishing and explicitly impersonates Google, targeting users with the expectation of receiving a token‑related airdrop. The current operational status is offline, and the site is no longer reachable. Defenders should treat the observed indicators as high‑confidence evidence of a Google‑brand credential‑phishing campaign.
Immediate actions include adding the domain, its IP address, and the two nameservers to existing URL and DNS blocklists. Because the infrastructure relies on Cloudflare, similar future campaigns may reuse the same ASN, so outbound traffic to AS13335 should be monitored for anomalous request patterns. The registrar information suggests that other domains created by PDR Ltd. could be leveraged for related attacks; threat‑intel feeds should be queried for newly registered domains using the same registrar within the past week.
भेजे गए प्रमाण का स्नैपशॉट
- भेजा गया
- लेज़र रिकॉर्ड
- 1
- केस आईडी
PD-20260202-491A76- कैप्चर किए गए पेज का शीर्षक
- TOKEN_NAME | Airdrop
- PDF दस्तावेज़
- PDF प्रमाण
कानूनी आधार
प्रमाण का पूरा पाठ
Section 3.1 of the AUP: The domain get-bag.fun is actively engaged in phishing activities, attempting to deceive users into providing sensitive personal information, which constitutes a clear violation of your Acceptable Use Policy prohibiting fraud and deception.
Section 5.2 of the TOS: The continued operation of this domain undermines the integrity of your services and violates your Terms of Service, which reserve the right to suspend or terminate services for any illegal activities.
Applicable Laws (Unknown):
Computer Fraud and Abuse Act (CFAA): This U.S. federal law prohibits unauthorized access to computers and fraudulent activities involving computers, applicable to phishing schemes.
Wire Fraud Statute (18 U.S.C. § 1343): This law criminalizes schemes to defraud individuals or entities using electronic communications, which is relevant to the phishing activities associated with this domain.
Anti-Phishing Consumer Protection Act: This legislation aims to combat phishing by imposing penalties on those who engage in deceptive practices to acquire sensitive information.
Regulatory Note: Failure to take immediate action against this domain may expose your organization to legal liability and regulatory scrutiny. Compliance with your AUP and TOS is essential to maintain the integrity of your services and protect your users.
Data Coverage
धमकी प्रतिक्रिया पाइपलाइन
ब्लॉकलिस्ट कवरेज
10 निगरानी वाले बाहरी स्रोत · संग्रहीत स्नैपशॉट 11/08/2026
पहचान समयरेखा
-
Cloudflare Radar
Cloudflare Radar स्कैन संग्रहीत · स्कैन खोलें
सहेजा गया कैप्चर
डोमेन इंटेलिजेंस
तकनीकी विवरणDNS, TLS नाम और समय-मुद्राएँ
ICANN OVERSIGHT
प्रत्यायन और आरएए संदर्भ
प्रत्यायन और आरएए संदर्भ
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
फॉरेंसिक इंटेलिजेंस
वायरसटोटल विश्लेषण
क्या आप इस साइट से प्रभावित हुए?
यदि आपने खाता क्रेडेंशियल, व्यक्तिगत या भुगतान जानकारी दर्ज की है, या इस डोमेन से कोई फ़ाइल डाउनलोड की है, तो तुरंत कार्रवाई करें। घटना की रिपोर्ट करने और अपनी सुरक्षा करने में आपकी सहायता के लिए नीचे संसाधन दिए गए हैं।
अपने स्थानीय अधिकारियों को रिपोर्ट करें
आधिकारिक साइबर अपराध संपर्क, या एक शिकायत ड्राफ्ट बनाएं → प्राप्त करने के लिए अपना देश चुनें।
किसी भी डोमेन की जाँच करें
संग्रहीत ब्लॉकलिस्ट, WHOIS, DNS और सार्वजनिक स्कैन साक्ष्य का उपयोग करके खतरे का विश्लेषण
अभी स्कैन करेंफ़िशिंग की रिपोर्ट करें
संदिग्ध डोमेन हमारे थ्रेट डेटाबेस में जमा करें — समुदाय की सुरक्षा करें
रिपोर्ट करेंसीधा खतरा फीड
हाल की फ़िशिंग रिपोर्टें और उपलब्धता में परिवर्तन देखे गए
निगरानी करेंजानकारी में रहें, सुरक्षित रहें
लाइव खतरों की निगरानी करें या यदि आपको लगता है कि यह एक गलत सकारात्मक है तो इस लिस्टिंग को चुनौती दें।