satelite-star[.]icu

The domain satelite-star.icu is currently under investigation for credential theft targeting users of Starlink's eSIM services. Analysis of the page title, 'eSIM Virtual Starlink | Internet Via Satélite no Telemóvel,' indicates an attempt to impersonate Starlink's satellite internet offerings, specifically their mobile eSIM products. The domain is presently offline, but prior activity suggests a focus on harvesting login credentials or payment details from users seeking mobile satellite internet access. Infrastructure analysis reveals the domain was registered on April 28, 2026, through FewMoreTaps OÜ, an entity frequently associated with high-risk registrations. It resolves to the IP address 34.111.179.208 and uses a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy to phishing sites. Despite its malicious intent, the domain has not been flagged by any of the 95 vendors on VirusTotal, though it appears on one security blocklist and was previously blocked by PhishDestroy. Gridinsoft assigns it a trust score of 0/100, and AlienVault OTX includes it in one threat intelligence pulse, further corroborating its malicious nature. Current status indicates the domain has been taken offline, likely due to enforcement actions or the conclusion of a short-lived campaign. However, the infrastructure remains a potential risk for future abuse. Organizations and users are advised to monitor for re-registration or similar domains under the same registrar. Network defenders should block the IP address 34.111.179.208 and implement detection rules for domains impersonating Starlink or satellite internet services. Users who may have interacted with the domain should reset credentials for any associated accounts and enable multi-factor authentication where available. Security teams are encouraged to review logs for connections to the IP or domain to identify potential compromise.