starrytrades[.]org

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

The domain starrytrades.org was registered through GO54 LIMITED on 25 August 2024 and is presently taken offline. Passive DNS shows it resolving to 198.12.93.82, an address owned by AS36352 HostPapa in the United States. The authoritative nameservers are ns1.megatronserver.com and ns2.megatronserver.com, and no TLS certificate is present, meaning traffic is served only over HTTP. The site presented the page title “Starry Trades” and was classified as a brand‑impersonation campaign targeting Binance.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal recorded a single positive detection out of ninety‑five submitted scanners. PhishDestroy has also listed the domain as blocked. The limited detection footprint suggests a low‑volume or short‑lived operation, but the use of a reputable hosting provider and a generic nameserver set indicates potential reuse for future malicious sites.

Because the site lacks HTTPS, credential capture would occur over unencrypted channels, increasing the risk of interception. Defenders should immediately block the domain and its resolving IP at perimeter firewalls, add the host to internal threat‑intel feeds, and monitor for any new subdomains or similar registrations under the same registrar or nameserver pair. Continued observation of the AS36352 address range is advised, as threat actors may pivot to additional domains hosted on the same infrastructure. Organizations that rely on Binance‑related services should educate users to verify URLs and enforce multi‑factor authentication to mitigate credential reuse.