jeostarkystore[.]com

This domain, jeostarkystore.com, is actively flagged as a high-risk brand impersonation site targeting American Express. Analysis indicates the domain was registered on October 30, 2025, through a major registrar and currently resolves to the IP address 23.227.38.32. The infrastructure relies on Cloudflare for hosting and security, a common tactic to obscure the true origin of malicious activity while leveraging HTTP/3 and HSTS to appear legitimate. The page title, 'jeostarky,' does not match the expected branding of the targeted financial institution, further suggesting deceptive intent. Security vendors have detected this domain as malicious, with 5 out of 95 engines on a widely used threat intelligence platform flagging it. It appears on two security blocklists and has been documented in 23 threat intelligence pulses, indicating a pattern of malicious behavior rather than an isolated incident. The domain also scores a trust rating of 0 out of 100, reinforcing its classification as a confirmed threat. Technologies such as Shopify and jQuery are present, which are frequently exploited in phishing campaigns to create convincing storefronts or credential harvesting pages. While the exact content of the site has not been analyzed, the combination of infrastructure, registration details, and threat intelligence signals strongly suggests it is designed to deceive users into divulging sensitive financial information. Defenders should treat this domain as an active phishing threat and prioritize blocking it at the network and endpoint levels. Monitoring for related domains registered through the same registrar or resolving to the same IP may help identify additional threats in this campaign. Given the domain's persistence despite detection, organizations should also assess whether internal systems have been exposed to it and take remediation steps if necessary.