starknet[.]beefy[.]bar

starknet.beefy.bar is a recently registered domain that has been classified as a brand‑impersonation instrument targeting the Starknet ecosystem. The domain was created on 1 October 2025 and is registered through Dynadot LLC. Its authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and it resolves to the IP address 142.250.184.196, which belongs to AS15169 (Google LLC) and is geolocated in the United States. No TLS certificate was observed for the host, indicating that HTTPS connections are not offered. A passive web fetch returned the HTML title “Google”, but no further page content has been captured; therefore the exact landing page layout and any credential‑collection mechanisms remain unknown.

Threat‑intel aggregators have flagged the domain. VirusTotal recorded detections from two of ninety‑five scanning engines, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, which has now taken the site offline. The offline status suggests that the hosting provider or the takedown request has removed the content, yet the DNS records remain resolvable.

Analysts should treat the domain as hostile infrastructure. Defensive measures include adding the domain and its resolved IP address to network‑level deny lists, updating web‑filtering and email‑gateway signatures to capture the observed indicators, and monitoring the associated Cloudflare name servers for future malicious registrations. Continuous watch on the registrar Dynadot for newly created domains that reference Starknet or use similar naming patterns is recommended. Because the page title is generic and the site is currently inactive, further verification of payloads cannot be performed at this time, but the existing technical indicators warrant proactive blocking and threat‑intel sharing with peers.