starknet[.]airdropsalert[.]bar

Analysis indicates that the domain starknet.airdropsalert.bar was registered through Dynadot LLC on 20 October 2025 and currently resolves to the IP address 172.217.18.4, which belongs to AS15169 Google LLC located in the United States. The domain is hosted on infrastructure that uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, yet it presents no TLS certificate, leaving the HTTP service unencrypted. The site returns a generic page title of “Google” and does not provide any visible content that has been publicly analyzed; the only observable attribute is its classification as a crypto‑related brand impersonation targeting the Starknet ecosystem.

Detection services have flagged the domain: twelve out of ninety‑three VirusTotal security vendors have reported it as malicious, and it appears on a single external blocklist that is actively enforced by PhishDestroy. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain’s risk rating is elevated, and its status is currently offline, suggesting that the infrastructure may be intermittently taken down to evade detection.

Defenders should immediately add starknet.airdropsalert.bar to network deny lists, enforce DNS filtering, and monitor for any resurgence of the domain or associated IP address. Because the site lacks SSL, any attempted connections would be exposed to potential credential harvesting, and the association with a crypto scam implies possible attempts to lure Starknet users into fraudulent token giveaways or wallet address submissions. Continuous observation of the hosting AS and the Cloudflare nameservers is recommended to detect future repurposing of the same infrastructure for similar impersonation campaigns.