stellular-truffle-25b117[.]netlify[.]app

Threat intelligence identifies stellular-truffle-25b117.netlify.app as an active credential-harvesting domain posing as a legitimate login portal. This domain mimics a branded authentication page to trick users into surrendering credentials, which are then exfiltrated to attacker-controlled servers. Analysis confirms the infrastructure is hosted on IP 35.157.26.135 and leverages a DigiCert SSL certificate to appear legitimate and evade browser warnings. The domain was registered via Netlify and has already triggered detections from 19 of 95 VirusTotal security vendors, indicating elevated risk and active abuse in phishing campaigns.

This domain was flagged by 19 out of 95 VirusTotal security vendors, confirming widespread recognition of its malicious intent. It resolves to IP address 35.157.26.135 and is registered through Netlify, a platform often abused by threat actors to host convincing phishing pages with minimal friction. The presence of a valid DigiCert SSL certificate further enhances its credibility, increasing the likelihood of successful deception. The campaign is currently active and represents a credible threat to users who may encounter it through email, social media, or malicious advertisements.

If you visited stellular-truffle-25b117.netlify.app, assume your credentials were compromised and immediately change passwords for any accounts entered. Enable multi-factor authentication on all related accounts and review recent login activity for anomalies. Report the domain to your security team or ISP and avoid any further interaction. Consider using a password manager to detect and prevent reuse of credentials on fraudulent sites. Monitor financial accounts and enable transaction alerts if sensitive data was entered. Stay alert for follow-on phishing attempts leveraging this breach.