mstr[.]sbs

This domain is flagged for elevated-risk brand impersonation targeting cryptocurrency users through a fraudulent airdrop scheme. Analysis indicates the domain mstr.sbs was specifically designed to mimic MicroStrategy's legitimate operations, leveraging the page title 'MicroStrategy xStock Airdrop' to lend false credibility to the scam. The threat type aligns with a growing trend of token distribution frauds exploiting corporate partnerships and investment hype in the digital asset space. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on February 21, 2026, through Global Domain Group LLC, with resolution to IP address 104.21.58.73. Security vendor detections include 6/95 flags on VirusTotal, while blocklist presence spans three independent security lists, including MetaMask and SEAL. Additional indicators include a Gridinsoft trust score of 28/100, an SSL certificate issued by Google Trust Services, and backend technologies such as HSTS, Font Awesome, and HTTP/3. The domain appears in one AlienVault OTX threat intelligence pulse, confirming its classification as active malicious infrastructure prior to takedown. Mitigation requires multi-layered defenses specific to airdrop scams. Users should verify all token distribution announcements through official corporate channels, particularly those involving cryptocurrency transfers or wallet connections. Network-level protections should incorporate the domain's IP address (104.21.58.73) and registrar details (Global Domain Group LLC) into blocklists. Security teams are advised to monitor for similar patterns, including domains combining corporate names with 'sbs' TLDs, Cloudflare-hosted infrastructure, and recent creation dates. Wallet providers should implement transaction warnings for any interactions with addresses linked to this domain or its associated IP range.