claim[.]stblofficial[.]xyz

The domain claim.stblofficial.xyz has been confirmed as a phishing site conducting brand impersonation attacks specifically targeting Binance users. The site displayed a page titled 'Use Your Stablecoin, Keep Your Yield that's STBL.com,' which mimics legitimate cryptocurrency platforms in order to deceive visitors. The infrastructure and content patterns are consistent with known cryptocurrency drainer kits, where users are lured to connect wallets or disclose sensitive credentials under false pretenses.

Technical analysis reveals several concrete indicators of malicious activity. VirusTotal currently lists 3 out of 95 security vendors flagging the domain as malicious. The domain was registered on September 16, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS records show resolution to IP address 104.21.30.81. The domain’s trust score is rated 0/100 by Gridinsoft, with its appearance on at least two security blocklists. Additionally, it has been blocked by major threat intelligence providers. The use of a recently registered domain and a zero trust score further indicate high risk.

As of the latest investigation, claim.stblofficial.xyz has been taken offline, mitigating the immediate threat. Response actions included rapid blocklisting and network-level blocking by multiple threat intelligence feeds. While the domain is no longer operational, users who may have interacted with the site before takedown are advised to review their accounts for unauthorized activity and change any exposed credentials. Ongoing monitoring for related domains using similar naming conventions or infrastructure is recommended to preempt future attacks.