foundation-starknet[.]xyz

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting StarkNet, a zero-knowledge execution layer for Ethereum and Bitcoin. Analysis indicates the infrastructure was designed to deceive users by presenting itself as legitimate StarkNet services, potentially facilitating fraudulent transactions or unauthorized access to crypto assets. The threat type is narrowly classified as brand impersonation, with no evidence of credential theft or crypto drainer functionality at this time, though such capabilities cannot be ruled out in prior versions of the site. Infrastructure analysis reveals the domain foundation-starknet.xyz was registered on June 3, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive domains. It resolved to the IP address 188.114.97.3, which is part of a network range known for hosting both legitimate and malicious content. The domain appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and ScamSniffer, and is referenced in four AlienVault OTX threat intelligence pulses. Detection rates remain low, with only 1 out of 95 security vendors on VirusTotal flagging the domain at the time of assessment. Technologies detected include Cloudflare, Cloudflare Browser Insights, and HTTP/3, suggesting the use of a content delivery network to obscure hosting origins and evade takedown efforts. The page title, 'Starknet | The ZK Execution Layer Scaling Ethereum and Bitcoin,' precisely matches official StarkNet branding, further confirming the intent to impersonate. Mitigation measures should focus on disrupting user interaction with the domain and preventing further brand abuse. Network-level blocking of the domain and its resolving IP (188.114.97.3) is recommended for organizations handling crypto-related traffic. Users who may have interacted with the domain should verify wallet permissions and transaction histories for unauthorized activity, particularly if the site prompted for wallet connections or approvals. Given the domain's current offline status, monitoring for re-registration or re-emergence under similar naming conventions (e.g., starknet-foundation.xyz, starknet-secure.xyz) is advised. Security teams should correlate the domain's indicators with internal logs to identify potential prior exposure. For crypto service providers, preemptive warnings to users about brand impersonation tactics targeting StarkNet infrastructure may reduce successful exploitation.