stellar[.]airdrpsalert[.]sbs

Analysis of stellar.airdrpsalert.sbs indicates that the domain was registered through Dynadot LLC on 22 October 2025. The authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com resolve the domain to the IPv4 address 172.253.63.103, which is announced by AS15169 belonging to Google LLC and geolocated to the United States. The HTTP response lacks an SSL/TLS certificate, meaning the site is served over plain HTTP. The page title returned by the server is "Google", matching the declared brand target and confirming a brand‑impersonation intent.

VirusTotal records show that three out of ninety‑five scanned scanners flagged the domain, and the domain appears on a single external blocklist, specifically PhishDestroy, which has already taken the site offline. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The domain currently reports an offline status, suggesting that active hosting has been terminated or blocked. While the available data confirm the infrastructure and branding elements, no additional artifacts such as phishing kits, payload hashes, or observed login capture behavior have been published.

Consequently, the full scope of the campaign, including victim targeting or any credential harvesting mechanisms, remains unknown. Defenders should continue to monitor DNS queries for the domain and its associated IP address, enforce blocklists that include the identified nameservers, and ensure that any internal redirects to the domain are intercepted. Given the association with Google’s IP space, organizations may consider adding the IP to network‑level deny lists only after confirming that legitimate Google services are unaffected, to avoid inadvertent disruption. Ongoing threat‑intel feeds should be consulted for any future re‑use of the same registration details or hosting patterns.