starknet[.]airdrpalert[.]click

starknet.airdrpalert.click was registered on 30 Oct 2025 through Dynadot LLC. DNS resolution points to 142.250.80.100, an address owned by AS15169 Google LLC located in the United States. The domain is served by Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate was observed, indicating HTTP‑only access. The only visible page title returned by the web server is "Google", which does not correspond to the claimed brand. The site is classified as a brand‑impersonation campaign targeting Starknet.

It appears on a single public blocklist and is listed by PhishDestroy as blocked. VirusTotal scans show three of ninety‑five AV engines flagging the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The domain has been taken offline at the time of analysis (status: offline). Evidence suggests the infrastructure leverages Google‑owned IP space while relying on Cloudflare DNS, a pattern often used to obscure true hosting.

No SSL/TLS, no further page content, and no additional indicators were available. Defenders should add the domain to network deny lists, monitor for any resurrection of the host or similar sub‑domains, and consider the IP 142.250.80.100 as suspicious when observed in conjunction with brand‑impersonation traffic. Ongoing vigilance is recommended, especially for users of Starknet services, to prevent credential harvesting attempts.