starburst-france[.]com

The domain starburst-france.com was registered on March 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The registration date places the domain within the current operational window of the observed campaign. The domain name itself mimics a legitimate brand, suggesting an attempt to lure victims by visual similarity.

Technical probing shows the domain resolves to the IP address 188.114.96.3, which is associated with a Cloudflare network located in Canada. DNS resolution uses the authoritative nameservers edna.ns.cloudflare.com and etienne.ns.cloudflare.com. An HTTPS endpoint is present; the presented certificate is issued by Google Trust Services under the WE1 root, indicating a valid TLS chain. HTTP requests return a 403 status and the page title is reported as “Just a moment…”, a common placeholder used by automated phishing kits.

Reputation services assign a Gridinsoft trust score of 0 out of 100, and the domain is currently listed on a single security blocklist. PhishDestroy has already blocked the domain, and the risk level is marked as under investigation with an active status. No detections have been recorded on the primary malware scanning platform, but the absence of detections does not imply benign intent.

Defenders should add starburst-france.com to internal block lists and monitor DNS queries for outbound connections to the resolved IP. Network traffic to the domain should be inspected for credential harvesting patterns, and any email messages referencing the domain should be quarantined pending user verification. Continuous re‑evaluation is advised as additional indicators may emerge.