starnexis[.]site

The domain starnexis.site is a phishing site engaged in brand impersonation targeting Discord users. It presents itself as a legitimate Discord-related service but is designed to deceive victims into disclosing login credentials or other sensitive information. No crypto drainer kit was identified in this campaign. The site is currently taken offline, though prior activity classified it as an elevated-risk threat.

Technical indicators confirm the malicious nature of starnexis.site. The domain was flagged by 2 of 95 VirusTotal security vendors, including SOCRadar, and appears on 1 security blocklist (PhishDestroy). Registered through NameCheap, Inc. on October 15, 2025, it resolved to the IP address 172.67.170.91, hosted on Cloudflare's network (AS13335) in the US. No SSL certificate was issued, and the observed page title was 'Shade Network — The Private Execution Layer'. Nameservers for the domain are james.ns.cloudflare.com and norah.ns.cloudflare.com. Gridinsoft assigned a trust score of 0/100, further indicating its fraudulent intent.

Victims of starnexis.site should immediately change any passwords entered on the site, particularly for Discord accounts, and enable two-factor authentication (2FA) if not already active. Monitor accounts for unauthorized activity and report any suspected fraud to Discord's official support channels. To prevent further exposure, users may also report the domain to their security software provider or platforms like Google Safe Browsing. If financial or crypto assets were involved, revoke any token approvals and consider transferring funds to a new wallet.