ranchimallstellarwallet[.]pages[.]dev

Analysis of ranchimallstellarwallet.pages.dev shows a newly registered site created on 06 Mar 2026 that leverages Cloudflare’s DNS and CDN infrastructure. The domain resolves to 172.66.47.136, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. An SSL certificate issued by Google Trust Services (WE1) is present, indicating a valid TLS handshake despite the malicious intent. The HTTP response returned a 403 status code at the time of collection, and the page title reported by the crawler is “Stellar Wallet – RanchiMall”, matching the scam type classified as wallet/seed phishing.

The site has been flagged by three independent blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft’s trust scoring engine assigned a score of 0/100, reflecting a high confidence of malicious behavior. VirusTotal analysis recorded detections from 4 of 94 security vendors, reinforcing the classification. The domain is currently offline, but the underlying infrastructure – Cloudflare nameservers (tina.ns.cloudflare.com, will.ns.cloudflare.com) and the same IP range – remains reusable for future campaigns.

Defenders should add the domain and its resolving IP to deny‑list rules, monitor for re‑registration or new subdomains under the same registrar, and ensure that wallet‑related traffic is inspected for anomalous seed‑phishing patterns. Continuous telemetry from blocklist feeds and endpoint protection should be correlated to capture any resurgence. Given the elevated risk rating and the brand‑impersonation intent, organizations handling cryptocurrency assets should treat any contact from this domain as malicious and educate users to verify legitimate wallet URLs.