stabledrop-cap[.]app

This domain, stabledrop-cap.app, operates as a confirmed cryptocurrency swap phishing endpoint designed to harvest wallet credentials and private keys through a fraudulent interface. Analysis indicates the site mimics legitimate decentralized exchange platforms, presenting users with a fabricated token-swapping interface labeled 'Swap | cap' to induce unauthorized transactions or credential disclosure. The threat specifically targets users interacting with blockchain-based financial services, leveraging social engineering to exploit trust in decentralized protocols. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on June 20, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk registrations. It resolves to the IP address 172.67.163.10, hosted behind a content delivery network that obscures the origin server. Detection metrics further substantiate the malicious nature: 8 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on 2 independent security blocklists. Additionally, the domain is actively blocked by two major wallet security providers, indicating confirmed abuse in credential theft campaigns. Users who have interacted with stabledrop-cap.app should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet. All credentials or private keys entered on the site must be considered compromised and should be rotated across all services. Monitoring for unauthorized transactions is critical, as the threat actor may attempt to drain funds or execute additional phishing attacks using harvested data. Security teams should update blocklists to include this domain and its associated IP address, while users are advised to verify domain authenticity through official project channels before engaging with any decentralized financial interfaces.