astr[.]airdropsalert[.]us

Analysis of astr.airdropsalert.us, which was registered on 18 Oct 2025 through Dynadot LLC, shows a high‑risk brand‑impersonation campaign targeting Google users with a crypto‑scam payload. The site presented a page title of “Google”, confirming the intent to masquerade as the legitimate brand. No TLS certificate was observed, meaning the service was delivered over plain HTTP, a common characteristic of fast‑moving phishing infrastructure. The domain resolved to 192.178.155.106, an address allocated to AS15169 Google LLC in the United States; the association with Google’s own network may be the result of a compromised host or misuse of legitimate address space. Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com were configured, providing DNS‑level resiliency.

VirusTotal scans recorded detections from 12 of 93 security vendors, indicating that multiple independent engines identified malicious activity. The domain appears on one external blocklist and has been actively blocked by the PhishDestroy service. Google Safe Browsing classified the site under social engineering, reinforcing the phishing nature of the content. A Gridinsoft trust score of 0 / 100 further reflects the low reputation of the host.

The infrastructure is currently offline, but the historical artifacts remain relevant for detection and mitigation. Defenders should ensure that DNS resolvers and web proxies deny any resolution of astr.airdropsalert.us, add the IP address 192.178.155.106 to network block lists, and monitor for any re‑use of the Cloudflare nameservers in new campaigns. Incident response teams should also query threat‑intel feeds for any resurgence of the domain or related indicators, and update endpoint security policies to flag any attempt to load a page with the title “Google” from an unauthenticated HTTP source. Continuous review of Google Safe Browsing and other reputation services is recommended to capture future re‑activations of this infrastructure.