starknet[.]airsdropsalert[.]click

The domain starknet.airsdropsalert.click is identified as a brand impersonation threat targeting Starknet, a decentralized Layer 2 network. This domain was operational under the guise of a legitimate airdrop alert service but has since been taken offline. Analysis indicates it was designed to deceive users into disclosing sensitive credentials or interacting with malicious smart contracts by mimicking Starknet’s official branding and communications. Infrastructure analysis reveals the domain was registered on November 05, 2025, through Dynadot LLC, a registrar frequently associated with high-risk domains. It resolved to the IP address 216.58.206.68, geolocated in Germany under AS15169 (Google LLC), though this appears to be a front or misdirection rather than legitimate hosting. The domain was flagged by 13 of 95 security vendors on VirusTotal, indicating a consensus on its malicious nature. Additionally, it appeared on one security blocklist and was proactively blocked by PhishDestroy. Notably, the domain lacked an SSL certificate, a red flag for user security, and displayed a misleading page title of 'Google,' further obscuring its true intent. As of the latest assessment, starknet.airsdropsalert.click has been taken offline, reducing immediate risk to end users. However, organizations and individuals should remain vigilant for similar impersonation attempts, particularly those leveraging airdrop-themed lures. It is recommended to monitor for newly registered domains with similar naming patterns, enforce blocklisting of known malicious IPs, and educate users on verifying domain authenticity before interacting with any Starknet-related communications. Security teams should also review logs for connections to 216.58.206.68 and correlate with other indicators of compromise associated with this campaign.