stellarwallet[.]space

On 24 July 2026 the domain stellarwallet.space was observed hosting a wallet‑seed phishing page. The site resolved to the IPv4 address 62.173.139.159, which is announced by AS34300 Internet‑Cosmos LLC and geolocated to Russia. The domain’s authoritative name servers are ns7.wmrs.ru and ns8.wmrs.ru, and registration was performed through the REGRU‑RU registrar on 20 November 2025. No TLS certificate was presented, indicating the site operated over plain HTTP at the time of capture. The page title returned by the HTTP response is “Stellar Wallet | XLM Web Wallet | Stellar Lumens Online Wallet”, suggesting an attempt to lure users of the Stellar cryptocurrency ecosystem.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single public blocklist. VirusTotal analysis recorded five detections out of ninety‑five scanned scanners, confirming malicious intent. The phishing campaign was also flagged by the PhishDestroy blocklist. The site is currently taken offline, and no further HTTP content is reachable. Analysis indicates that the infrastructure aligns with a typical wallet‑seed harvesting operation: a recently created domain, Russian hosting, and lack of encryption.

The limited number of VirusTotal detections and a single blocklist entry suggest the campaign had modest exposure before takedown. Defenders should continue to monitor the associated IP address and name‑server pair for any re‑use, enforce outbound filtering of connections to 62.173.139.159, and add stellarwallet.space to internal blocklists. Threat‑intel feeds that ingest Gridinsoft scores, PhishDestroy listings, and VirusTotal detections can be tuned to raise alerts on similar future registrations. Because the site is offline, active probing is not possible, but periodic re‑resolution of the domain may reveal re‑hosting attempts.