stellartrustbank[.]com

The domain stellartrustbank.com was observed hosting a banking‑phishing campaign and is currently taken offline. Registration data show the domain was created on 15 December 2025 through DreamHost and is delegated to the authoritative name servers ns1.systemxhost.cc and ns2.systemxhost.cc. DNS resolution points to the IPv4 address 152.53.181.59, which belongs to AS197540 netcup GmbH in Germany. No TLS certificate is presented, indicating the site was served only over plain HTTP.

HTTP headers reveal the use of the LiteSpeed web server and support for HTTP/3, while the page title returned by the server is the generic “Index of /”, providing no additional context about the malicious payload. Threat intelligence indicates the domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal scans report that 15 of 95 antivirus and URL‑reputation engines flagged the domain, reflecting a moderate level of detection across the security community. The Gridinsoft trust score is recorded as 0 out of 100, reinforcing the classification as a malicious resource.

Available evidence confirms the campaign’s intent as banking phishing, but the exact content served, credential‑capture mechanisms, and any associated command‑and‑control infrastructure remain undisclosed. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole lists, and monitor for any resurgence of the IP address or related name‑server patterns. Because the site lacks SSL, any attempted connections will fail if TLS enforcement is applied, providing an additional mitigation layer. Ongoing observation of the netcup hosting range and the DreamHost registrar may reveal future re‑use of similar infrastructure.