bnc[.]airdropsalert[.]bar

Analysis of bnc.airdropsalert.bar indicates that the domain was registered on October 20, 2025 through Dynadot LLC. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, which are operated by Cloudflare. DNS resolution points to 172.217.18.4, an address owned by AS15169 Google LLC and geolocated to the United States. No TLS certificate was observed, meaning the site served only HTTP. The HTTP response returned a page whose title is simply "Google", matching the declared brand target of Google and confirming a brand‑impersonation motive. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reports that 15 of 95 scanned security vendors flagged the domain, reflecting a consensus of malicious intent.

The domain is listed on a single public blocklist and has been explicitly blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of high risk. The only identified scam type is a crypto‑related scam, consistent with the "Crypto Scam" label in the intelligence set. The current operational status is offline, suggesting that the phishing infrastructure has been taken down or is no longer serving content.

However, the underlying registration and hosting artifacts remain observable and could be reused by threat actors. No additional content analysis, such as login forms or payload delivery mechanisms, is available, leaving the precise phishing workflow uncertain. Defenders should continue to enforce block rules for the domain and its associated IP range, monitor for re‑registration or similar sub‑domains, and incorporate the observed indicators—registration date, registrar, nameserver set, IP address, lack of TLS, safe‑browsing flag, VirusTotal detection count, and trust score—into detection pipelines. Ongoing threat‑intel feeds should be consulted for any resurgence of activity linked to this infrastructure.