starknet[.]beefy-hub[.]sbs

The domain starknet.beefy-hub.sbs was registered on October 25, 2025 through Dynadot LLC and is currently taken offline. Infrastructure analysis shows the domain resolves to IP address 142.250.185.164, which belongs to Google LLC (AS15169) and is located in the United States. The domain uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but it does not present an SSL/TLS certificate, leaving the connection unencrypted. The only visible page title returned by the server is "Google," providing no direct indication of malicious content.

Threat intelligence indicates the site is classified as a Brand Impersonation campaign targeting the Starknet brand. It appears on a single security blocklist, PhishDestroy, and VirusTotal reports that 15 of 95 scanning engines flagged the domain as malicious. Additional reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. While the offline status limits immediate exposure, the combination of a reputable hosting provider, lack of encryption, and blocklist presence suggests the domain was used to lure users into a Starknet‑related phishing flow.

Uncertainties remain regarding the specific payload or credential‑ harvesting mechanisms employed, as no page content beyond the generic title has been captured. Defenders should continue to block the domain at network perimeter devices, monitor DNS queries for the domain and its associated Cloudflare name servers, and update endpoint protection signatures to reflect the 15 vendor detections. Incident response teams should also advise users to verify any unexpected Starknet communications and to avoid entering credentials on sites lacking proper TLS certificates.