starkqibot[.]com

This domain, starkqibot.com, is flagged for credential theft activity targeting unsuspecting users through deceptive login portals. Analysis indicates no direct impersonation of a known brand or cryptocurrency drainer kit at this time, though the infrastructure aligns with common phishing deployment patterns. The domain lacks prior malicious associations but exhibits characteristics consistent with credential harvesting campaigns, including the use of legitimate-looking SSL certificates and hosting on cloud-based infrastructure. Infrastructure analysis reveals starkqibot.com was registered through NAMECHEAP INC on April 13, 2026, and currently resolves to the IP address 99.84.152.38. VirusTotal reports 0 detections out of 95 engines, indicating no prior flagging by security vendors. The domain's SSL certificate is issued by Amazon, a common provider for both legitimate and malicious sites. Google Safe Browsing (GSB) currently lists no active warnings, and no blocklist entries have been recorded as of this report. The creation date suggests a recently deployed asset, which may explain the lack of prior detection. The domain remains active and under investigation, with no takedown actions observed at this time. Users are advised to block the domain and IP address 99.84.152.38 at the network level, particularly in environments where credential theft poses a high risk. Monitoring for related subdomains or newly registered domains under the same registrar is recommended, as this infrastructure may be repurposed for additional campaigns. Given the absence of detections, organizations should prioritize behavioral analysis of network traffic to this endpoint, particularly for unexpected authentication requests or redirects.