starknet[.]beefyapp[.]lol

Analysis of the domain starknet.beefyapp.lol indicates a brand‑impersonation campaign targeting the Starknet ecosystem. The domain was registered on 5 October 2025 through Dynadot LLC and points to the IP address 142.250.185.100, which belongs to Google LLC (ASN 15169) located in the United States. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both associated with Cloudflare’s DNS service. No TLS certificate is presented, and the site currently returns an offline HTTP status, consistent with the “taken offline” note in the intelligence feed.

Passive scanning on VirusTotal shows that 12 of 95 security vendors have flagged the domain as malicious, reinforcing the suspicion of abuse. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of credibility. The page title returned by the HTTP response is “Google”, which does not correspond to the targeted brand and may be an attempt to obscure the malicious intent.

Given the absence of an SSL certificate, the presence of Google‑owned infrastructure, and the use of Cloudflare DNS, the operator appears to rely on legitimate hosting services to lend credibility to the malicious site. The primary uncertainty is the exact content that was served before the takedown, as no visual or functional analysis is available. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicator, and monitor for any resurgence of the same second‑level domain or similar patterns. Additional investigation of the IP 142.250.185.100 for other related domains may reveal further infrastructure reuse.