stellartem[.]com

This domain, stellartem.com, is flagged as a credential harvesting phishing site specifically targeting cryptocurrency wallet users. Analysis indicates no direct brand impersonation, but the infrastructure and content patterns align with generic crypto-phishing campaigns designed to steal private keys, seed phrases, or login credentials. No evidence of a drainer kit was observed, though the domain exhibits characteristics typical of low-sophistication phishing operations leveraging social engineering tactics. Infrastructure analysis reveals the following technical indicators: the domain was registered on September 10, 2025, through Cloud DNS Ltd and resolves to the IP address 104.21.58.162, hosted on AS13335 (Cloudflare, Inc.) in the United States. VirusTotal reports 9 out of 95 security vendors flagging this domain as malicious. The domain appears on one security blocklist and is currently not listed in Google Safe Browsing. No SSL certificate is present, increasing the likelihood of detection by browser security mechanisms and reducing the domain's perceived legitimacy to potential victims. As of the latest assessment, stellartem.com has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the risk remains elevated for residual exposure, particularly if the domain is reactivated or repurposed. Organizations and individuals are advised to block the domain and its associated IP at the network level. End-users should be cautioned against interacting with any content from this domain, even if it reappears under altered infrastructure. Continuous monitoring of related indicators of compromise is recommended due to the transient nature of such threats.