starknet[.]beefyhubs[.]bond

The domain starknet.beefyhubs.bond was registered on October 26, 2025 through Dynadot LLC and currently resolves to the IPv6 address 2607:f8b0:4004:c07::69, which belongs to AS15169 operated by Google LLC in the United States. The site presents a page title of "Google" and does not serve an SSL certificate, indicating that any traffic would be unencrypted. According to the provided intelligence, the domain is classified as a brand impersonation campaign targeting Starknet and has been taken offline at the time of analysis. Independent security tools have assigned it a Gridinsoft trust score of 0 out of 100, reflecting the highest level of suspicion.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal reports that six of ninety‑five scanning engines flag the domain, providing modest corroboration of malicious intent. Nameserver records point to brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both Cloudflare‑operated resolvers, which is a common pattern for fast‑flux or rapidly redeployed malicious infrastructure.

The evidence does not include any TLS certificate, login page screenshots, or detailed payload analysis, so the exact phishing vector remains unknown beyond the brand‑impersonation label. Defenders should add starknet.beefyhubs.bond to DNS blocklists and firewall deny rules, monitor for re‑registration or similar algorithmically generated subdomains, and enforce strict outbound filtering to prevent inadvertent connections to the associated IPv6 address. Continuous re‑scanning with multi‑vendor services is recommended to capture any future changes in detection scores or payload delivery methods.