starcheck[.]io

On 18 October 2023 the domain starcheck.io was registered through NameCheap, Inc. The authoritative name servers brad.ns.cloudflare.com and demi.ns.cloudflare.com resolve the domain to a Cloudflare‑provided IPv6 address (2a06:98c1:3120::3) that is associated with AS13335, a Cloudflare network located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS endpoint. An HTTP request returns status code 200, and the page title observed is “StarCheck | AML&KYC software for crypto”, suggesting an attempt to appear as a legitimate anti‑money‑laundering and KYC solution for cryptocurrency services. The domain is flagged as impersonating the brand “base” and is categorized as an investment scam in the intelligence feed. Infrastructure analysis reveals the use of a modern JavaScript stack: Node.js, Express, Nuxt.js, Vue.js, and Stripe integration, together with analytics and monitoring services such as Google Analytics, Hotjar, and HSTS enforcement. The presence of Stripe may indicate a payment collection component, while the combination of these frameworks is consistent with a clone of legitimate SaaS‑type portals.

The site has been added to at least one public security blocklist and is listed as blocked by the PhishDestroy service. A single security blocklist entry further confirms that external threat‑intelligence providers have observed malicious activity associated with the domain. VirusTotal scans show that 2 of 91 scanned security vendors flagged the domain, providing additional corroboration of malicious behavior. The low Gridinsoft trust score of 0 / 100 reflects a consensus of poor reputation across automated reputation services. MX records point to Google’s mail infrastructure (aspmx.l.google.com and alt2.as), which may be used for phishing communications but do not alone confirm malicious use.

The available evidence strongly suggests that starcheck.