allocation-starknet[.]xyz

PhishDestroy identifies allocation-starknet.xyz (seed c9c13e) as a domain engaged in active brand impersonation targeting StarkNet. This site mimics official StarkNet branding to deceive users into connecting wallets or entering credentials. The domain employs a drainer kit designed to siphon assets or harvest private keys upon interaction, posing a direct threat to cryptocurrency users. Threat actors have leveraged this domain in phishing campaigns to exploit trust in the StarkNet ecosystem, likely distributing links via social media or fake announcements. This domain resolves to IP address 188.114.96.3 and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on May 10, 2026. The SSL certificate is issued by Let's Encrypt, providing a false sense of legitimacy. VirusTotal reports a detection score of 2 out of 95 security vendors, indicating low but present suspicion. The domain is currently blocked by MetaMask and SEAL, and appears on two active security blocklists, including Google Safe Browsing (GSB). These technical indicators confirm malicious infrastructure with recent deployment and partial evasion of detection systems. As of the latest analysis, allocation-starknet.xyz remains active and unremediated. Response actions include real-time blocking by MetaMask and SEAL, as well as inclusion in multiple threat intelligence feeds. Despite these measures, the domain continues to pose an elevated risk due to its recent creation and targeted impersonation strategy. Users are advised to avoid this domain entirely, verify all StarkNet-related links through official channels, and report any exposure to security teams. Remaining risk is assessed as elevated given the domain’s active status and the possibility of continued exploitation in ongoing phishing campaigns.