starknet[.]app-airdropalert[.]lat

The domain starknet.app-airdropalert.lat was registered through Dynadot LLC on November 10, 2025 and currently resolves to the IP address 142.250.181.228, which is owned by Google LLC (AS15169) and located in the United States. The domain is configured with Cloudflare authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but it presents no SSL certificate and is presently taken offline. Reputation data shows a Gridinsoft trust score of 0 out of 100, indicating an extremely low trust rating.

VirusTotal scans have flagged the domain in 12 of 95 security vendor engines, and it appears on a single security blocklist, confirming that multiple independent sources have identified it as malicious. The page title returned from the host is "Google," and the site is categorized as a crypto scam that impersonates the Starknet brand. PhishDestroy has already blocked the domain, reinforcing its classification as a brand‑impersonation threat.

While the offline status limits direct observation of the payload or phishing landing page, the combination of low trust score, multiple vendor detections, and explicit brand impersonation suggests a high likelihood of credential‑stealing or token‑theft activity targeting Starknet users. Defenders should add the domain to DNS and URL filtering policies, monitor for any future re‑activation of the host, and watch for similar sub‑domain patterns that combine "airdropalert" with legitimate brand names. Continuous threat‑intel feeds should be consulted for any resurgence, and any internal alerts referencing Starknet‑related phishing attempts should be correlated with this indicator to improve detection coverage.