# PhishDestroy domain threat record: star.claims750.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/star.claims750.com/
Machine-readable companion: https://phishdestroy.io/domain/star.claims750.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 15:14:23 UTC
- Last availability or vendor check: 2026-10-28 00:30:46 UTC
- Stored record updated: 2026-10-28 00:30:46 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 64.29.17.65
- Registrar in stored WHOIS data: TUCOWS.COM, CO.
- Registrar country in stored WHOIS data: KN
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-08-31 08:25:26 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17dec-6e1f-72da-b43b-d3949ab16e1d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/star.claims750.com
- Certificate Transparency search: https://crt.sh/?q=%25.star.claims750.com
- Web Archive lookup: https://web.archive.org/web/*/https://star.claims750.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated intake on 2026-10-27 classified the site as malicious because it pretends to be Starbucks and promises “Starbucks Rewards” vouchers in exchange for completing sponsored deals. The recorded page title reads “Starbucks Rewards Offer” and the page excerpt includes the phrase “Starbucks Rewards Offer SStarbucksClaim up to $100 in Starbucks vouchers,” confirming the brand‑impersonation claim. An HTTP 200 response was observed on the same date, indicating the page was reachable at that time.

How the scam works
Impersonation phishing pages copy a well‑known brand’s visual style and name to lure victims into believing the offer is legitimate. They typically promise rewards, vouchers or cash in return for completing surveys, product trials or app downloads, collecting personal data or login credentials. The promised reward never materialises, and any information supplied can be used for further fraud or account takeover. This pattern matches the generic “brand‑impersonation reward” scheme.

Evidence
The domain was listed in PhishDestroy’s internal blocklist on 2026-10-27. VirusTotal recorded one detection from 92 engines on 2026-10-27, marking the domain as suspicious and labeling it as spam (Fortinet). Google Safe Browsing checked the same day and did not flag the URL. URLScan captured the page on 2026-10-27, assigning a malicious verdict with a score of 100, categorising it as phishing and identifying the Starbucks brand. OTX reported zero pulses on the same date, and external blocklists returned no matches.

Infrastructure
The page resolved to the IP address 64.29.17.65, associated with the Network Billing Systems organization in the United States. The site was served through Vercel’s CDN and used a Let’s Encrypt TLS certificate valid from 2026-09-15 to 2026-12-14. The domain’s sub‑domain star.claims750.com was 41 days old at the time of observation, while the apex claims750.com had existed for 706 days. No registrar or registration date details are available.

What to do
Users should avoid entering any Starbucks credentials or personal data on the site and, if they have already done so, change their Starbucks account password and monitor for unauthorised activity. Organizations should block star.claims750.com at the DNS or proxy level, add the recorded IP 64.29.17.65 to deny‑list rules, and review logs for any connections to that address. Since no wallet‑related actions were observed, no wallet‑specific remediation is required.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17dec-6e1f-72da-b43b-d3949ab16e1d/
Cloudflare Radar report: https://radar.cloudflare.com/scan/6b76a923-3f2d-47af-8e55-c7d4a0983c22
Stored capture screenshot: https://i.ibb.co/Mysg2G8v/28eaefefd3f2.png
URLScan screenshot (2026-09-15T16:10:43Z): https://screenshots.phishdestroy.io/us/01a0a5d5-9ed8-7091-88b0-d9c6b0eb4c74.png
URLScan capture report: https://urlscan.io/result/01a0a5d5-9ed8-7091-88b0-d9c6b0eb4c74/
URLScan screenshot (2026-10-27T15:09:04Z): https://screenshots.phishdestroy.io/us/01a17de8-4109-7327-a765-6e026a4c9242.png
URLScan capture report: https://urlscan.io/result/01a17de8-4109-7327-a765-6e026a4c9242/
VirusTotal report: https://www.virustotal.com/gui/domain/star.claims750.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=star.claims750.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 15:15:45 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Mysg2G8v/28eaefefd3f2.png
  Captured: 2026-10-27 15:14:23 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17dec-6e1f-72da-b43b-d3949ab16e1d.png
  Captured: 2026-10-27 15:14:23 UTC
  Source report: https://urlscan.io/result/01a17dec-6e1f-72da-b43b-d3949ab16e1d/
- URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a5d5-9ed8-7091-88b0-d9c6b0eb4c74.png
  Captured: 2026-09-15 16:10:43 UTC
  Source report: https://urlscan.io/result/01a0a5d5-9ed8-7091-88b0-d9c6b0eb4c74/
  SHA-256: 16858f66626217450b780d6dcaebbe719d51569f34ca6dd27bab314031458798
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17de8-4109-7327-a765-6e026a4c9242.png
  Captured: 2026-10-27 15:09:04 UTC
  Source report: https://urlscan.io/result/01a17de8-4109-7327-a765-6e026a4c9242/
  SHA-256: 16858f66626217450b780d6dcaebbe719d51569f34ca6dd27bab314031458798
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6b76a923-3f2d-47af-8e55-c7d4a0983c22.png
  Captured: 2026-10-27 15:14:42 UTC
  Source report: https://radar.cloudflare.com/scan/6b76a923-3f2d-47af-8e55-c7d4a0983c22
  SHA-256: 6c16a0c8b227acd9c6dc0bbe84873ed5490df4f0cac77d9b90cf15a3f4c2ef69
- URLQuery: https://screenshots.phishdestroy.io/uq/ffcc82a7-02c1-4334-a118-4ee9481ca372.png
  Source report: https://urlquery.net/report/ffcc82a7-02c1-4334-a118-4ee9481ca372
  SHA-256: aae2063eca1a62dd44b51c61f8df9739f303b1df0034f8485ea45d0dcbb510bc

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T15:14:56Z",
        "uuid": "01a17dec-6e1f-72da-b43b-d3949ab16e1d",
        "scanned_at": "2026-10-27T15:13:36Z",
        "final_url": "https://star.claims750.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://star.claims750.com/",
                "from": "http://star.claims750.com/",
                "status": 307
            }
        ],
        "ip": "64.29.17.65",
        "ips": [
            "64.29.17.65"
        ],
        "asns": [
            "16509"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "trksy.org"
        ],
        "doc_hash": "531ec5efe7486ff045b4b1d93a97543dc84400fad70d5364199e3e90cfb52c93",
        "script_hashes": [
            "161ab04fecc45eb1d3ca01ce34450039fc9d32927c9a9dcf926941e1d84cf0a1",
            "8bf791795e8fc81db1a750f2ba34fc4bb6e2f35e4b47966aafe7e5443a808ee4",
            "01406f80d69a67d6355325fd02ff6c9629a570d172bc615330b442a69ceca97a",
            "4cf25c345db7ae882d12f9fdb24840e549609ab8bcbf95026d74927b9e00ecea",
            "085b3844eca743000f41d81ced71fd0a1cd31e283259b8adea50149bc71152b3",
            "a1d388835b564addd336974f554b8d508c010145a6ce81f8d6ce8cdc334fbbc9",
            "050e35bf7e6e96590f2a9de114c14ff792806ed28457b3248762944350c0ba4c"
        ],
        "globals": [
            "__next_f",
            "TURBOPACK",
            "next",
            "__webpack_hash__",
            "vam",
            "va",
            "vaq",
            "vai"
        ],
        "tls": {
            "san": [
                "star.claims750.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "star.claims750.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-14T15:07:13Z",
            "valid_from": "2026-09-15T15:07:14Z"
        },
        "domain_age_days": 41,
        "apex_age_days": 706,
        "tls_age_days": 42,
        "tls_valid_days": 89,
        "requests": 12,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 78,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "starbucks"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Starbucks"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "Vercel",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=63072000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T16:09:24Z",
        "uuid": "6b76a923-3f2d-47af-8e55-c7d4a0983c22",
        "scanned_at": "2026-10-27T15:14:42Z",
        "final_url": "https://star.claims750.com/",
        "status": 200,
        "history": [
            {
                "url": "https://star.claims750.com/",
                "status": 200
            }
        ],
        "dom_hash": "cbba1a5f83505854ecf28da3fd5812923c9598272389a9e07c23df8f062ba21e",
        "doc_hash": "531ec5efe7486ff045b4b1d93a97543dc84400fad70d5364199e3e90cfb52c93",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "star.claims750.com",
                "type": "CNAME",
                "value": "cd97de28adf94c84.vercel-dns-017.com"
            },
            {
                "name": "star.claims750.com",
                "type": "CNAME",
                "value": "cd97de28adf94c84.vercel-dns-017.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.16",
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "created": "2026-08-31T10:25:26Z",
            "updated": "2026-08-31T10:25:27Z",
            "expires": "2027-08-31T10:25:26Z",
            "nameservers": [
                "1-you.njalla.no",
                "2-can.njalla.in",
                "3-get.njalla.fo"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T15:14:39Z",
        "analysis_at": "2026-10-27T03:14:14Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 40
        },
        "detections": {
            "Fortinet": "spam"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Tucows Domains Inc.",
        "created": "2026-08-31T10:25:26Z",
        "expires": "2027-08-31T10:25:26Z",
        "updated": "2026-08-31T10:25:27Z",
        "first_seen": "2026-09-15T17:24:01Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "64.29.17.1"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "216.198.79.1"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 60,
                "type": "CNAME",
                "value": "cd97de28adf94c84.vercel-dns-017.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "pki.goog"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "globalsign.com"
            }
        ],
        "dns_at": "2026-10-27T03:14:29Z",
        "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb",
        "cert": {
            "san": [
                "star.claims750.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "62626f8889b82b7b373f73fbd02b77497da",
            "sha256": "16eff3261a58b352a7d909e338cd407ac314796b2c6a0a3a9bd71aadeee13375",
            "subject": "star.claims750.com",
            "valid_to": "2026-12-14T15:07:13Z",
            "valid_from": "2026-09-15T15:07:14Z"
        },
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "registrar_iana_id": "69",
            "registrar_url": "http://www.tucows.com",
            "created": "2026-08-31T10:25:26Z",
            "updated": "2026-08-31T10:25:27Z",
            "expires": "2027-08-31T10:25:26Z",
            "status": [
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "1-you.njalla.no",
                "2-can.njalla.in",
                "3-get.njalla.fo"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T15:15:21Z",
        "caa_records": {
            "count": 4,
            "domain": "star.claims750.com",
            "issuers": [
                "letsencrypt.org",
                "pki.goog",
                "sectigo.com",
                "globalsign.com"
            ]
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "social_tags": {
            "title": "Starbucks Rewards Offer",
            "generator": "v0.app",
            "themeColor": "#f8f7f2",
            "description": "Learn how to claim Starbucks rewards through this promotional offer."
        },
        "trackers": {
            "requests": 8
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 17,
                "tls": 157,
                "wait": 25,
                "connect": 8,
                "download": 1
            },
            "response_ms": 208
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 19029,
            "co2_grams": 0.0007,
            "cleaner_than": 58
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "185.193.124.34",
                    "host": "2-can.njalla.in"
                },
                {
                    "ip": "95.215.19.5",
                    "host": "3-get.njalla.fo"
                },
                {
                    "ip": "185.193.124.2",
                    "host": "1-you.njalla.no"
                }
            ],
            "zone": "claims750.com"
        },
        "location": {
            "ip": "216.198.79.1",
            "asn": "16509",
            "org": "Network Billing Systems",
            "city": "Atlanta",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "star.claims750.com"
        },
        "dns": {
            "A": [
                "64.29.17.1",
                "216.198.79.1"
            ],
            "CNAME": [
                "cd97de28adf94c84.vercel-dns-017.com"
            ]
        },
        "dnssec": {
            "ds": true,
            "rrsig": false,
            "dnskey": true
        },
        "hsts": {
            "header": "max-age=63072000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=63072000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "216.198.79.1",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://star.claims750.com"
            ]
        },
        "subdomains": {
            "count": 19,
            "subdomains": [
                "arr.claims750.com",
                "bag.claims750.com",
                "col.claims750.com",
                "dec.claims750.com",
                "dep.claims750.com",
                "dunk.claims750.com",
                "jelly.claims750.com",
                "lulu.claims750.com",
                "mart.claims750.com",
                "mec.claims750.com",
                "nand.claims750.com",
                "nord.claims750.com",
                "olive.claims750.com",
                "prim.claims750.com",
                "sam.claims750.com",
                "star.claims750.com",
                "ult.claims750.com",
                "wmart.claims750.com",
                "wool.claims750.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Node.js",
                "React",
                "Next.js",
                "Vercel",
                "Vercel Analytics",
                "Priority Hints",
                "HSTS",
                "Webpack"
            ]
        },
        "linked_pages": {
            "external": [
                "https://trksy.org/aff_c"
            ],
            "external_count": 1
        },
        "whois": {
            "registrar": "Tucows Domains Inc.",
            "created": "2026-08-31T10:25:26Z",
            "updated": "2026-08-31T10:25:27Z",
            "expires": "2027-08-31T10:25:26Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "clientUpdateProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "1-you.njalla.no",
                "2-can.njalla.in",
                "3-get.njalla.fo"
            ]
        },
        "headers": {
            "headers": {
                "server": "Vercel",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=63072000"
            }
        }
    }
}
```