stellarcoin-stb[.]cc

This domain, stellarcoin-stb.cc, operates as a credential harvesting site specifically designed to target cryptocurrency wallet users. Analysis indicates the infrastructure presents fraudulent login interfaces mimicking legitimate Stellar-based platforms, with the intent to capture seed phrases, private keys, or account credentials. The phishing pages are served under the guise of wallet recovery or token airdrop schemes, a common tactic in cryptocurrency-related fraud. Infrastructure analysis reveals the domain was registered on July 19, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 172.67.128.34, hosted on Cloudflare's network (AS13335). Security vendor detections on VirusTotal stand at 5 out of 95, while the domain appears on one security blocklist. The SSL certificate is classified as WE1, a low-trust indicator often associated with short-lived or disposable domains. Cloudflare's interstitial warning page, titled 'Suspected phishing site,' further corroborates the malicious classification. Users who have interacted with stellarcoin-stb.cc should immediately revoke any permissions granted to connected applications or browser extensions. All credentials entered on the site must be considered compromised and should be changed from a secure device. Cryptocurrency wallets used on the site should be migrated to new addresses, and any associated seed phrases or private keys must be discarded. Network-level blocking of the domain and its resolving IP (172.67.128.34) is recommended to prevent further exposure. Monitoring for unauthorized transactions or account access attempts is advised for a minimum of 30 days post-exposure.