starlightgc[.]icu

PhishDestroy identifies starlightgc.icu as an active fake-login phishing domain luring users to surrender credentials under deceptive branding. This site is engineered to harvest usernames and passwords in real time. Threat actors rapidly weaponize newly registered domains to masquerade as trusted services, aiming to harvest authentication tokens and initiate account takeovers. The risk to end-users is immediate and severe, as stolen credentials can be reused across multiple platforms, leading to financial loss and identity theft.

Technical indicators tie starlightgc.icu to a known infrastructure cluster. The domain resolves to IPv4 address 37.49.229.75, registered on April 22, 2026 through Global Domain Group LLC, and secured with a Let’s Encrypt SSL certificate—all tactics used to appear legitimate. VirusTotal currently shows 6 out of 95 detection engines flagging the domain, indicating it remains under the radar. Despite the lack of antivirus coverage, the domain’s youth and hosting profile suggest a high-risk profile consistent with emerging phishing operations. No blocklist entries are yet visible, but trust scores across domain reputation services are expected to be low due to its recent creation and single-purpose deployment.

Mitigation requires immediate action by users and defenders. Avoid visiting or interacting with starlightgc.icu; never input credentials or personal data on the site. Block the domain and IP at network perimeter and DNS levels using threat feeds. Report the domain to PhishDestroy, browser vendors, and domain registrars for takedown. If credentials were entered, rotate passwords immediately, enable multi-factor authentication where possible, and monitor accounts for unauthorized access. Organizations should update browser policies and security controls to block newly registered domains with low reputation scores and no historic content.