stellar[.]org[.]im

The domain stellar.org.im is currently classified as a generic phishing site with a high risk rating and an active status as of 12 July 2026. The page title returned by the web server is identical to the domain name, offering no additional context about the intended victim or lure. No visual or functional analysis of the page content is available, so the assessment relies exclusively on the observed infrastructure and reputation signals. Infrastructure analysis shows the domain resolves to the IP address 172.105.47.42, which belongs to the Akamai Connected Cloud network (AS63949) and is hosted by Linode. The nameservers ns1.in1.fcomet.com and ns2.in1.fcomet.com are also associated with the same provider. The web server reports HTTP status 200 and serves content over a Let’s Encrypt certificate (R13). Technical fingerprints indicate a WordPress site powered by MySQL, PHP, Bootstrap, jQuery, jQuery Migrate, and LiteSpeed, with HTTP/3 enabled. Reputation data reinforces the malicious classification. VirusTotal scans have flagged the domain in 13 out of 95 security engines, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single public blocklist and is explicitly blocked by PhishDestroy, confirming that at least one anti‑phishing consortium has taken remediation action. These signals collectively point to a deliberately crafted phishing infrastructure rather than an accidental misconfiguration. Defenders should treat stellar.org.im as a confirmed phishing threat. Immediate mitigation steps include adding the domain and its associated IP address to network blocklists, configuring DNS sinkholing for the identified nameservers, and monitoring for any outbound connections to the hosting ASN. Because the exact phishing payload and targeted brand remain unknown, continuous traffic analysis and endpoint telemetry are recommended to capture any credential‑harvesting attempts that may originate from this host.