w[.]airdropsalert[.]bar

Analysis of w.airdropsalert.bar indicates that the domain was registered on 20 October 2025 through Dynadot LLC and is hosted on Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The domain resolves to IP 142.250.191.4, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. No TLS certificate is presented, meaning the site is served over plain HTTP. The page title returned from the site is “Google”, matching the declared brand target and confirming that the operator is attempting to impersonate Google.

The threat classification from the supplied intelligence is a crypto‑scam that leverages brand impersonation. VirusTotal has recorded 14 positive detections out of 95 scanned vendors, and the domain appears on one security blocklist, where it has been flagged by PhishDestroy. The current status is listed as offline, suggesting the site has been taken down or is temporarily unavailable. Because the site is not presently reachable, no HTTP response code, content body, or additional metadata can be observed, leaving the exact delivery mechanism of the crypto‑scam uncertain.

Nevertheless, the combination of a Google‑related page title, lack of SSL, alignment with a known crypto‑scam pattern, and multiple vendor detections provides strong evidence of malicious intent. Defensive actions should include adding the domain to local blocklists, updating DNS‑sinkhole configurations, and ensuring that any outbound connections to the resolved IP are logged and inspected. Continuous monitoring of the IP address is advised, as adversaries may repurpose the same infrastructure for future campaigns. Organizations should also educate users about unexpected Google‑related URLs, especially those that claim to distribute cryptocurrency rewards, to reduce the risk of credential harvesting or malware delivery.