stellar-wallet[.]org

PhishDestroy identifies stellar-wallet.org as an active crypto drainer posing significant risk to cryptocurrency users. This domain is designed to trick victims into connecting wallets and draining funds through deceptive web interfaces mimicking legitimate crypto wallet services. The threat level is elevated due to confirmed active malicious operations and the presence of established crypto drainer toolkits embedded in the site infrastructure.

This domain was flagged by 2 out of 95 security vendors on VirusTotal, indicating low but concerning detection rates. It is registered through NameSilo, LLC, resolving to IP address 195.66.213.19 and secured with a Let's Encrypt SSL certificate. The domain was created on March 28, 2026, making it a very recent registration, a common tactic among threat actors to avoid historical reputation-based detection. Despite the low immediate detection count, the use of a legitimate-looking SSL certificate combined with recent registration suggests an attempt to appear trustworthy at first glance. There are no public reports of inclusion on major blocklists such as Google Safe Browsing or PhishTank, but the absence of detection does not equate to safety.

To mitigate risk, users should avoid visiting stellar-wallet.org entirely. If you have previously interacted with this domain, disconnect all wallet connections immediately and revoke any unauthorized permissions via your wallet’s interface. Never input seed phrases or private keys on any website. Use hardware wallets for transactions and verify URLs against official sources. Report the domain to your antivirus provider and consider blocking the IP 195.66.213.19 at the network level. Stay alert for similar domains using slight misspellings or urgent language to impersonate legitimate services.