astr[.]airdropsalert[.]app

On 23 July 2026 the domain astr.airdropsalert.app was observed to be offline but retains indicators of a high‑risk brand‑impersonation campaign targeting Google. The domain was registered on 26 March 2013 through Cloudflare, Inc., and resolves to the IPv4 address 142.250.184.196, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. Despite the use of a legitimate Google‑owned IP range, the site did not present an SSL/TLS certificate, resulting in an unencrypted HTTP endpoint. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on a single external blocklist, where it is listed by PhishDestroy as a crypto‑scam vector.

Reputation scoring from Gridinsoft assigns a zero‑point trust rating (0/100). VirusTotal analysis shows that 17 of 95 scanned security vendors flagged the domain, reinforcing the malicious assessment. The page title returned by the HTTP request is “Google”, matching the declared brand target and confirming the intent to impersonate the corporate brand. The campaign is described as a crypto scam, although the specific payload or transaction mechanisms were not captured before the takedown.

Because the infrastructure leverages a Google‑owned IP, detection based solely on IP reputation is unreliable; defenders should rely on domain‑level indicators such as the registrar, lack of TLS, low trust score, Safe Browsing flag, and the VirusTotal detection count. Mitigation steps include adding astr.airdropsalert.app to blocklists at the DNS and proxy layers, enforcing HTTPS‑only policies to prevent connections to non‑TLS endpoints, and monitoring for any re‑registration attempts that might reuse the same domain label or similar subdomains. Continuous observation of Cloudflare‑registered domains that resolve to Google AS numbers is recommended, as threat actors may exploit legitimate hosting resources to host fraudulent pages.