starcoinbase[.]cc

Analysis of starcoinbase.cc indicates an active phishing domain targeting cryptocurrency users, currently under investigation. The domain was registered on May 23, 2026, through NameSilo, LLC, a registrar frequently associated with low-reputation registrations. Infrastructure analysis reveals the domain resolves to IP address 172.67.133.70, hosted on Cloudflare nameservers lilith.ns.cloudflare.com and rohin.ns.cloudflare.com, a configuration commonly observed in phishing campaigns to obscure hosting origins and evade takedowns. As of July 29, 2026, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, suggesting detection by specialized anti-phishing systems.

Despite its presence on these blocklists, the domain has not been flagged by any of the 91 security vendors in the most recent VirusTotal scan, though the absence of detections does not confirm legitimacy. The domain’s registration pattern, hosting infrastructure, and blocklist presence collectively indicate a high likelihood of malicious intent, though the specific phishing kit or targeted brand remains unconfirmed. Defenders are advised to treat starcoinbase.cc as a potential threat to cryptocurrency users.

Network-level blocking based on the resolved IP and domain name is recommended, particularly for organizations handling digital asset transactions. Further monitoring and analysis are required to determine the exact nature of the phishing content, including whether it employs credential harvesting, crypto wallet drainers, or other fraudulent mechanisms. Additional intelligence may emerge as the campaign develops, and updates should be incorporated into defensive measures accordingly.