starfhelp[.]icu

The domain starfhelp.icu was registered on May 09, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. Threat intelligence classifies it as a high‑risk generic phishing campaign targeting credential collection. The site returns HTTP 403 for requests, indicating that the front‑end is deliberately restricting access while likely serving malicious content to specific victims. Infrastructure analysis shows the domain resolves to IP address 104.21.20.132, which is hosted by Cloudflare, Inc. in Canada. The presence of Cloudflare’s DNS resolvers braden.ns.cloudflare.com and veronica.ns.cloudflare.com confirms the use of Cloudflare’s reverse‑proxy services. The TLS certificate is issued by Let’s Encrypt (E8), providing a valid HTTPS endpoint that may lend the site an appearance of legitimacy. Detection data corroborates the malicious intent. AlienVault OTX includes the domain in one threat‑intel pulse, and the domain appears on a single security blocklist, where it is actively blocked by PhishDestroy. VirusTotal scans have resulted in 2 out of 95 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 out of 100, reflecting a consensus of high danger among the limited sources that have evaluated it. Defenders should block traffic to 104.21.20.132 and add starfhelp.icu to internal deny lists. Monitoring of DNS queries for the associated Cloudflare nameservers can help identify compromised hosts attempting to resolve the domain. Organizations are advised to educate users about the risk of credential harvesting attempts originating from newly created domains with legitimate‑looking TLS certificates, and to apply strict email filtering for messages that reference the domain.