get-bag[.]fun

The domain get-bag.fun was registered on 2026-02-01 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on the Cloudflare network (AS13335) with the IPv4 address 172.67.173.95 located in the United States. The authoritative nameservers are ns1.suspended-domain.com and ns2.suspended-domain.com. No TLS certificate was presented at the time of observation, indicating the site was served over plain HTTP. Gridinsoft assigned a trust score of 0 / 100, and the site appears on a single external security blocklist. PhishDestroy has also listed the domain as blocked.

VirusTotal analysis shows that 10 of 93 scanned security vendors flagged the domain, confirming malicious behavior. The page title returned by the server is “TOKEN_NAME | Airdrop”, and the underlying phishing kit has been identified as the “Airdrop Scam” kit. The campaign is classified as credential phishing and explicitly impersonates Google, targeting users with the expectation of receiving a token‑related airdrop. The current operational status is offline, and the site is no longer reachable. Defenders should treat the observed indicators as high‑confidence evidence of a Google‑brand credential‑phishing campaign.

Immediate actions include adding the domain, its IP address, and the two nameservers to existing URL and DNS blocklists. Because the infrastructure relies on Cloudflare, similar future campaigns may reuse the same ASN, so outbound traffic to AS13335 should be monitored for anomalous request patterns. The registrar information suggests that other domains created by PDR Ltd. could be leveraged for related attacks; threat‑intel feeds should be queried for newly registered domains using the same registrar within the past week.