op[.]airdropsalert[.]bar

Analysis of the domain op.airdropsalert.bar indicates that it is part of a crypto drainer operation. The domain was registered through Dynadot LLC on October 20, 2025 and currently resolves to the IP address 104.21.21.238, which is announced by AS13335 and hosted by Cloudflare, Inc. in the United States. The TLS certificate presented by the site is identified as WE1, a common placeholder certificate that offers no validation of ownership. The domain appears on one security blocklist and is listed as blocked by the PhishDestroy service, confirming that defensive feeds have already flagged it as malicious.

VirusTotal scans show that 16 of 93 security vendors have flagged the domain, providing independent corroboration of its malicious nature. The threat is categorized as a crypto scam, specifically a crypto drainer, where victims are typically prompted to transfer cryptocurrency to an attacker-controlled wallet. The site’s HTTP status is reported as offline, and the current operational status is listed as taken offline, suggesting that the infrastructure may have been disrupted or is being rotated. No page title, brand, or toolkit information is available from the current intelligence set, and the content of the site has not been publicly captured.

Defenders should immediately block DNS resolution for op.airdropsalert.bar and the associated IP 104.21.21.238 at perimeter and endpoint controls. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is advised, as attackers often reuse the same hosting provider. Organizations should also review any recent outbound cryptocurrency transactions for potential exposure, given the domain’s classification as a crypto drainer. Incident response teams are encouraged to correlate logs for any DNS queries or HTTP requests to this domain with the timeframe after its registration to identify possible compromise attempts.