starknet[.]app-airdropalert[.]sbs

Analysis of the domain starknet.app-airdropalert.sbs indicates a crypto scam operation targeting users of the Starknet platform. The domain was registered on November 10, 2025, through Dynadot LLC and is currently offline as of July 23, 2026. Infrastructure analysis reveals Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), though no SSL certificate was detected. The domain resolved to IP address 142.250.184.196, hosted under Google LLC (AS15169) in the United States, which may reflect temporary or misconfigured hosting rather than a deliberate choice by the threat actor. Detection data shows 13 of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist (PhishDestroy).

Gridinsoft assigned a trust score of 0/100, reinforcing the elevated risk assessment. The page title 'Google' does not align with the domain's structure or stated brand target, suggesting either placeholder content or an attempt to evade automated detection. The scam type is explicitly classified as a crypto scam, and the domain impersonates Starknet, though no further details about the specific lure (e.g., airdrop, wallet drainer) are available from the current data. Defenders should treat this domain as high-risk for Starknet users.

While the site is offline, its infrastructure and detection history warrant continued monitoring. Organizations should block the domain at the DNS and proxy levels, and security teams may review logs for prior connections to 142.250.184.196 or the domain itself. Given the use of Cloudflare, additional domains under the same nameservers may warrant scrutiny. No evidence suggests this domain is part of a broader phishing kit or campaign, but the combination of brand impersonation, crypto scam classification, and detection by multiple vendors justifies proactive mitigation.