stellapluss[.]netlify[.]app

Analysis of stellapluss.netlify.app indicates an active phishing domain targeting cryptocurrency wallet users, classified with elevated risk as of July 29, 2026. The domain, registered through Netlify on May 8, 2018, currently resolves to IP address 63.176.8.218. Infrastructure analysis reveals detection by three of 91 security vendors on VirusTotal, while three independent security blocklists—including PhishDestroy, MetaMask, and SEAL—have flagged the domain for malicious activity.

The presence of these blocklist entries, combined with vendor detections, provides concrete evidence of ongoing phishing operations. No specific brand or scam kit is identified in available intelligence, though the MetaMask block suggests a likely focus on crypto wallet credential theft. The domain’s long registration period does not mitigate its current threat status, as phishing campaigns frequently repurpose older domains to evade detection.

Defenders should treat this domain as hostile and implement immediate blocking at the network and endpoint levels. Further investigation into associated IP infrastructure and SSL certificates may reveal additional indicators of compromise. Given the domain’s hosting on Netlify, defenders should also monitor for similar subdomains under the platform that may emerge as part of the same campaign.