starknet[.]airsdropalert[.]click

This domain is flagged as an elevated-risk phishing site specifically designed to deceive cryptocurrency users through fraudulent airdrop schemes. Analysis indicates the domain starknet.airsdropalert.click impersonates legitimate airdrop campaigns to harvest wallet credentials, private keys, or other sensitive authentication details. The infrastructure and naming convention strongly suggest an intent to exploit users expecting token distributions from StarkNet or related projects. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on November 05, 2025, through Dynadot, LLC, and currently resolves to the IP address 188.114.97.3. It appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal, including detection by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. The server displays a default nginx welcome page, which may indicate either a placeholder or a misconfigured phishing kit awaiting deployment. Mitigation requires immediate action from both end users and network defenders. Users should avoid interacting with starknet.airsdropalert.click and any associated links, particularly those promoting airdrops or wallet connections. Network administrators are advised to block the domain and its resolving IP (188.114.97.3) at the firewall or DNS level. Cryptocurrency wallet providers should monitor for transactions originating from this domain and alert users who may have engaged with it. Given the domain’s recent creation and offline status, further monitoring is recommended, as threat actors may reactivate or migrate the phishing infrastructure to new domains or IPs.