nft-stellar-buzz[.]pages[.]dev

PhishDestroy identifies nft-stellar-buzz.pages.dev as an active crypto drainer site, specifically designed to intercept and divert cryptocurrency transactions from unsuspecting NFT collectors. The domain leverages deceptive branding tied to the Stellar blockchain ecosystem, as suggested by its name, to lure victims into connecting their wallets under false pretenses. This site is part of a broader trend where phishing operators impersonate legitimate NFT projects or blockchain services to facilitate the unauthorized transfer of digital assets. Initial attribution suggests the use of a sophisticated drainer kit, though specific toolkits remain under further analysis due to the domain's recently observed activity. This domain resolves to the IP address 172.66.47.155, hosted by Cloudflare, Inc., which is commonly abused for evasion and infrastructure obfuscation. The domain was registered via Cloudflare and is currently covered by a Google Trust Services SSL certificate, enhancing its credibility to potential victims. VirusTotal currently flags this domain with a detection score of 1/95, indicating it remains undetected by major antivirus engines as of the latest scan. The site's infrastructure shows no signs of blocklisting, and no historical records of prior malicious activity are publicly associated with this domain. The lack of detections highlights the sophistication of the threat actor in evading traditional security controls. As of this advisory, nft-stellar-buzz.pages.dev remains active and under investigation with a high-risk potential. Immediate response actions include IP and domain blocking at the network perimeter and endpoint levels. Users are strongly advised to avoid interacting with the domain and to verify all NFT-related URLs through official channels. The remaining risk is classified as moderate to high, given the domain's current undetected status and the potential for rapid propagation across victim networks. Continuous monitoring and threat intelligence sharing are critical to mitigating this campaign's impact.