stellara-lens[.]pages[.]dev

PhishDestroy’s threat intelligence team has identified stellara-lens.pages.dev as an active phishing domain designed for credential harvesting. This fraudulent site masquerades as a legitimate service—likely leveraging the “lens” branding to deceive users into surrendering login credentials. The domain resolves to IP 188.114.96.3 and is currently under investigation after being registered via Cloudflare. Despite its use of a Google Trust Services SSL certificate, the site has not yet been flagged by VirusTotal, with 1/95 security engines detecting the threat at the time of analysis. This domain exemplifies a growing trend in phishing-as-a-service, where threat actors deploy lookalike pages to harvest sensitive user data. stellara-lens.pages.dev was registered through Cloudflare and is hosted on infrastructure associated with malicious campaigns. The lack of detection on VirusTotal highlights the stealthy nature of this operation and underscores the importance of proactive threat intelligence monitoring. Users interacting with this domain risk exposing personal information, including email addresses, passwords, and potentially financial details. If you visited stellara-lens.pages.dev, immediately change any passwords entered on the site and enable two-factor authentication on all linked accounts. Scan your device for malware using a reputable antivirus tool and monitor accounts for unauthorized access. Report the domain to your email provider and consider blocking it using your network’s firewall or DNS filtering. For a detailed breakdown of indicators and mitigation steps, review PhishDestroy’s full threat report linked below.