starknet[.]airdropsalert[.]live

Analysis indicates that the domain starknet.airdropsalert.live was created on 20 October 2025 and is registered through Dynadot LLC. The authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net, both typical of dynamic DNS services. Historical HTTP probing shows the site responded with status code 200 and delivered a page whose HTML title was “Google”. No TLS certificate was presented, confirming the absence of HTTPS protection. The domain resolved to IP address 216.58.206.68, which belongs to AS15169 Google LLC and is geolocated in Germany. Use of a Google‑owned IP suggests the operator leveraged legitimate cloud infrastructure to increase credibility and evade simple IP‑based blocking.

The site advertised a “Fake Airdrop” targeting the Starknet brand, as indicated by the brand target field and scam type. No additional page content has been captured, so the exact visual mimicry or credential‑harvesting mechanisms remain unknown. VirusTotal recorded 16 detections out of 95 scanned engines, indicating a moderate level of malicious consensus among security vendors. The domain appears on one external blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one third‑party repository has flagged it as malicious. Current operational status is offline, which may be a temporary takedown or a deliberate shutdown after a campaign window.

Defenders should proactively block the fully qualified domain name and its associated IP address at perimeter firewalls and DNS filtering solutions. Because the IP is shared with legitimate Google services, host‑based blocking should be applied with caution; instead, traffic inspection should focus on HTTP requests to the domain, especially those lacking TLS and containing the “Google” page title. Monitoring for newly registered domains using the same registrar, nameserver pattern, or similar sub‑domain structure (e.g., *.airdropsalert.live) can help detect follow‑on campaigns.