Highscore 46 · flagged Monday, November 2, 2026

starfare.top

Appeared in the .top zone on Monday, November 2, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: top
+8
brand in page title, not in the name
matched: telegram
+20
form on a brand-styled page
matched: has_form
+18
Registrar
—
Nameserver provider
Nameservers
1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo
First-day state
active website
HTTP status
200
Page title
Starfare — пополнение Steam и Telegram Stars
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks benignconfidence 60%· claude-opus-5-5

The page runs under its own 'Starfare' brand as a reseller for Steam wallet top-ups and Telegram Stars, with transparent pricing (8% fee, 2.30 ₽/⭐). It asks only for a Steam account name or @username and explicitly says 'not password', with no Steam or Telegram login imitation. The pre-funded balance, manual admin fulfilment, Njalla privacy nameservers and .top TLD carry some non-delivery risk but no evidence of fraud.

First passlooks like phishingtarget: Steam, Telegramconfidence 95%· claude-haiku-4-5

Page impersonates Steam and Telegram payment services to capture user credentials and payment data. The title explicitly references 'пополнение Steam и Telegram Stars' (Steam and Telegram Stars top-up), and the form requests Steam login/username and processes financial transactions, creating a sealed-room credential-harvesting scheme where funds are claimed to be credited by an 'admin' after capturing login details.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Monday, November 2, 2026

Screenshot of starfare.top taken by the zone census on 2026-11-02

Same data as JSON: /api/zone/domain/starfare.top. This page is not indexed by search engines and does not link to the site it describes.