starknet[.]beefy-hub[.]lol

Analysis indicates that the domain starknet.beefy-hub.lol was registered on October 25 2025 through Dynadot LLC. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, pointing to Cloudflare's DNS service. DNS resolution returns the IPv4 address 142.250.184.196, which belongs to AS15169, Google LLC, located in the United States. No TLS certificate is presented, confirming that the site does not support HTTPS. HTTP requests report an offline status, suggesting the site is currently not serving content, but the presence of a page title “Google” indicates that a simple HTTP response was captured at some point. Threat intelligence flags the domain as a brand‑impersonation campaign targeting Starknet.

Twelve of ninety‑five VirusTotal scanners flag the domain as malicious, and the domain appears on the PhishDestroy blocklist, confirming that at least one anti‑phishing service has taken action. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. No additional public blocklists, Safe Browsing entries, or OTX pulses are recorded in the supplied data. The combination of a recent registration date, use of reputable hosting infrastructure (Google Cloud) without TLS, and the absence of a valid certificate are tactics commonly observed in fast‑flux or throwaway phishing operations.

However, the current offline status limits immediate observation of payloads or credential‑harvesting pages, leaving the exact phishing vector unknown. Defenders should continue to monitor the domain for any re‑activation, enforce DNS‑based blocking at the resolver level, and add the domain to internal blocklists. Given the existing blocklist entry on PhishDestroy and the low trust score, network security appliances should treat traffic to this domain as malicious. Incident response teams should also review any recent logs for connections to 142.250.184.