play-stellar-base[.]xyz

play-stellar-base.xyz was registered through Dynadot LLC on 2025-01-08 and resolves to the IPv6 address 2606:4700:3032::6815:5ee6, which belongs to AS13335 Cloudflare, Inc., located in the United States. The domain is served by Cloudflare name servers aiden.ns.cloudflare.com and sierra.ns.cloudflare.com and does not present an SSL certificate, indicating HTTP‑only access. Public intelligence flags the site as a PayPal brand impersonation tied to a crypto‑scam campaign; the page title observed in the initial capture is “Chicken Road”. VirusTotal records show that 14 of 95 scanning engines have flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing its malicious profile.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. Current monitoring indicates the site has been taken offline, which limits immediate content analysis but does not eliminate the risk of re‑activation or reuse of the same infrastructure. Defenders should ensure the domain is added to URL filtering and firewall deny lists, especially those that enforce PayPal brand protection. Given the Cloudflare hosting, the underlying IP address may be shared with benign services, so block‑by‑domain is preferred to avoid collateral impact.

Continuous vigilance is recommended for any re‑registration attempts of the same second‑level domain or for similar naming patterns that combine “play‑stellar‑base” with other brand‑related terms. Threat intelligence feeds should be updated with the observed indicators—domain name, registration date, registrar, observed page title, and the IPv6 address—to enhance detection rules. Because the site is offline, further forensic capture of the HTTP response is pending; analysts should monitor for any resurgence and verify the presence of phishing kits or additional crypto‑drain payloads if the site becomes active again.