stellarpromotes[.]cloud

This domain operates as a crypto wallet drainer specifically targeting users of the Stellar blockchain network. Analysis indicates the site impersonates official Stellar interfaces to trick victims into connecting their wallets, enabling unauthorized transactions that siphon cryptocurrency assets to attacker-controlled addresses. The page title 'Blockchain | Stellar' directly mimics legitimate Stellar branding to establish false credibility with potential victims. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered through GoDaddy on April 21, 2026, with an unusually forward-looking creation date suggesting potential domain front-running or speculative registration. Security vendors flagged this domain in 14 out of 95 VirusTotal scans, while it appears on three independent security blocklists. The site resolves to IP address 129.121.87.240 and uses a Let's Encrypt SSL certificate, a common tactic among phishing operators to create an appearance of legitimacy. Users who visited stellarpromotes.cloud should immediately disconnect any connected wallets from the site and revoke all associated dApp permissions. Monitor wallet transaction history for unauthorized transfers and consider migrating assets to a new wallet if any suspicious activity is detected. The domain's use of Node.js, React, and Next.js technologies suggests a sophisticated frontend designed to closely replicate legitimate Stellar interfaces, making visual detection difficult for end users. Network administrators should block the domain and associated IP address across all security controls.