strk[.]airdropalert[.]us

The domain strk.airdropalert.us was registered on October 19, 2025 through Dynadot LLC and is currently reported as offline. It resolves to the IP address 142.251.111.104, which belongs to AS15169 Google LLC and is geolocated in the United States. The domain’s authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No SSL certificate is present, meaning the site does not support HTTPS and would be served over plain HTTP if accessed.

The page title returned during the limited observation was “Google,” matching the declared brand target of Google and confirming the domain’s intent to impersonate that brand. The site is classified as a crypto‑scam, although the specific payload or transaction mechanism was not captured before the takedown. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious activity.

The domain appears on one public blocklist, PhishDestroy, and has been flagged by 11 of 93 security vendors on VirusTotal, indicating that multiple detection engines have identified it as malicious. Given the combination of brand impersonation, lack of TLS, low trust score, and vendor detections, defenders should add strk.airdropalert.us to network and DNS blocklists, monitor for any DNS queries to the associated IP address, and consider the IP as potentially abused despite its legitimate ownership by Google. Continuous observation of Cloudflare name server patterns and similar “airdropalert” sub‑domains is advised, as threat actors may reuse this infrastructure for future campaigns.