stoax[.]xyz

stoax.xyz poses an elevated risk as a generic phishing domain, specifically designed to host a crypto drainer that targets cryptocurrency wallets. This site is currently offline, but its history and technical indicators suggest it was part of a coordinated phishing campaign aimed at stealing digital assets. PhishDestroy has classified this domain as a confirmed threat, urging users to avoid any interaction with it.

The domain was created on May 14, 2026, and registered through HOSTINGER operations, UAB, a registrar known for being abused by malicious actors. It resolves to IP address 82.29.181.154, which has been flagged by multiple security sources. VirusTotal reports that 13 out of 95 security vendors flag this domain as malicious, and it appears on 1 security blocklist. The page title was "STOA," which may have been used to impersonate a legitimate service. The SSL certificate was issued by Let's Encrypt, a free certificate authority often exploited by phishers to appear legitimate. These factors combined indicate a well-orchestrated phishing infrastructure with moderate trust scores.

To stay safe, users should never visit or enter any credentials or wallet information on stoax.xyz. If you have already interacted with this site, immediately transfer any cryptocurrency from affected wallets to a new, secure wallet and run a full antivirus scan on your device. Report the domain to cybersecurity authorities and monitor your accounts for unauthorized activity. Always verify URLs through PhishDestroy before engaging with unknown sites, and enable two-factor authentication on all sensitive accounts.