app-stargale-v11[.]top

Analysis of app-stargale-v11.top as of 25 July 2026 indicates the domain is being used for a brand‑impersonation campaign. The site was registered on 15 November 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the address 104.21.10.148 located in the United States. The authoritative nameservers george.ns.cloudflare.com and lindsey.ns.cloudflare.com confirm the use of Cloudflare’s DNS service. No TLS certificate is presented, meaning the site is served over plain HTTP, which is consistent with the “taken offline” status reported at the time of analysis.

Content inspection reveals the page title “GroveVex: Pioneering Innovations in Educational Technology,” which does not match any known reputable brand and suggests a fabricated corporate front. The domain is flagged by six of ninety‑five VirusTotal scanners, and Gridinsoft assigns a trust score of zero out of one hundred, indicating a high likelihood of malicious intent. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy filtering service.

The limited public intelligence shows the site impersonates “across,” a generic reference rather than a specific trademark, and is classified under the scam type “Brand Impersonation.” No additional indicators such as login forms, credential‑harvesting URLs, or malicious payloads have been disclosed, so the exact phishing vector remains unknown. Defenders should continue to block the domain at network perimeter and DNS levels, monitor for any resurgence of the host IP, and consider adding the IP address to threat‑intel feeds. Because the site is currently offline, ongoing verification of the payload and victim interaction is not possible, but the combination of low trust score, multiple vendor detections, and blocklist presence warrants elevated risk handling.