account[.]starbasefinancebanking[.]com

This domain, account.starbasefinancebanking.com, is flagged as an active high-risk phishing site targeting banking and cryptocurrency users. Registered on November 28, 2025, through Dynadot LLC, it resolves to IP 198.251.81.188 (AS53667 FranTech Solutions, US) and is currently listed on one security blocklist. The domain returns an HTTP 302 redirect and presents an 'Index of /' page title, suggesting either misconfigured or intentionally obfuscated content. While the exact brand impersonation is not confirmed, the scam type is classified as a crypto scam, indicating likely fraudulent financial activity. Infrastructure analysis reveals the use of Bootstrap and LiteSpeed technologies, alongside HTTP/3 support, which may aid in evading detection or improving performance. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. Nameservers ns17.my-control-panel.com and ns18.my-control-panel.com are associated with the domain, though their historical usage in phishing campaigns is not detailed here. Six of 95 security vendors on VirusTotal flag the domain as malicious, though this does not constitute exhaustive validation. Defenders should treat this domain as active and high-risk. Recommended actions include blocking resolution at the DNS or network level, monitoring for connections to the associated IP (198.251.81.188), and alerting users to potential crypto-related fraud. Further analysis of the redirect target or payload may clarify the specific attack vector, but current evidence supports immediate containment measures.