stellarlogs[.]dev

Analysis of the domain stellarlogs.dev indicates active credential phishing infrastructure targeting users through a deceptive portfolio-themed page. The domain, registered on April 16, 2025, via GoDaddy.com, LLC, currently resolves to the IP address 76.76.21.21, which is geolocated in the United States and associated with Vercel, Inc. infrastructure. The page presents itself as a professional portfolio under the title 'Tirtha | Fullstack Engineer & Tech Leader Portfolio,' a tactic commonly employed to establish false legitimacy and lower user suspicion during credential harvesting attempts. Technical indicators reinforce the phishing classification. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 7 out of 95 security vendors on VirusTotal. The site employs HSTS and a Let's Encrypt SSL certificate (R13), which may create a false sense of security for users while facilitating encrypted exfiltration of stolen credentials. Nameservers ns73.domaincontrol.com and ns74.domaincontrol.com further link the domain to a broader pattern of abuse observed across domains registered through the same registrar. While the exact phishing kit or payload remains unconfirmed, the combination of a newly registered domain, professional branding, and active blocklist presence aligns with known credential theft campaigns. The domain’s continued operation, returning an HTTP 200 status, suggests the campaign is ongoing and may escalate if unmitigated. Defenders are advised to block the domain at the network level, monitor for related subdomains or redirects, and alert users to the presence of this threat, particularly in environments where portfolio-themed lures are likely to appear credible.