spilltheteawithstellareid[.]com

This domain is flagged as a high-risk credential theft phishing site targeting users through deceptive login portals. Analysis indicates the infrastructure was designed to harvest sensitive account credentials, likely for financial fraud or unauthorized access to personal and corporate systems. The domain exhibits multiple indicators of malicious intent, aligning with known phishing campaigns observed in recent months. Infrastructure analysis reveals the domain spilltheteawithstellareid.com was registered on February 21, 2026, through NetEarth One Inc. d/b/a NetEarth. It resolves to the IP address 172.96.187.93, hosted under AS32475 (Internap Holding LLC) in the United States. The site uses a Let's Encrypt SSL certificate (R12) and displays a generic 'Default Web Site Page' title, a common tactic to evade initial suspicion. Security vendors on VirusTotal flagged the domain at a rate of 18/95, while three blocklists—PhishDestroy, MetaMask, and SEAL—have actively blocked it. Google Safe Browsing also classifies this domain as phishing, further corroborating its malicious nature. Mitigation steps for users and organizations include immediate blocking of the domain and its associated IP (172.96.187.93) at the network perimeter. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window, prioritizing financial, email, and single-sign-on services. Security teams are advised to monitor for anomalous authentication attempts and deploy multi-factor authentication (MFA) to mitigate the risk of credential-based attacks. Given the domain's current offline status, further monitoring of related infrastructure (e.g., registrar, IP range) is recommended to detect potential resurgence or lateral movement within the threat actor's operational framework.