stargate[.]finance-connect-walletv4[.]com

stargate.finance-connect-walletv4.com was registered on February 21, 2026 through MAT BAO CORPORATION. The domain resolves to the Cloudflare‑owned address 188.114.96.3, indicating the operator is leveraging Cloudflare's infrastructure to hide origin servers. The domain name combines the generic term “finance‑connect‑walletv4” with the prefix “stargate”, a pattern often observed in recent cryptocurrency‑drainer campaigns.

Network analysis shows the domain is served behind Cloudflare (AS13335) and supports HTTP/3. DNS is delegated to junade.ns.cloudflare.com and liz.ns.cloudflare.com. The site presents the page title “finance‑connect‑walletv4.com | 521: Web server is down”, while HTTP responses return a 403 status code, suggesting the malicious payload may be delivered only under specific request conditions or after the initial block page is bypassed. The TLS certificate is issued by Google Trust Services under the WE1 profile, confirming the use of a legitimate certificate chain.

Threat intelligence classifies the domain as a crypto drainer with a high risk rating. Two out of ninety‑five VirusTotal scanners have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. It appears on a single security blocklist and is already blocked by PhishDestroy. The combination of a fresh registration, legitimate TLS, and Cloudflare fronting is consistent with adversaries attempting to evade automated detection while targeting cryptocurrency users.

Defenders should add the domain to outbound and inbound blocklists, enforce DNS filtering, and monitor for connections to 188.114.96.3. Because the visible page only returns a generic 521 error, any downstream payload may be hidden behind redirects or require specific user interaction; therefore, traffic inspection at the TLS layer is advisable. Continuous re‑evaluation is recommended as additional samples may emerge, and further analysis of any retrieved content would clarify the precise phishing tactics employed.