stglbk[.]live

The domain stglbk.live has been identified as a credential theft operation targeting financial institution logins. Analysis indicates the site is designed to mimic banking portals, tricking users into submitting sensitive authentication details. As of the latest assessment, the domain has been taken offline, though prior activity suggests a focused campaign against retail banking customers. Infrastructure analysis reveals the domain was registered through Global Domain Group LLC on July 04, 2025, and resolved to the IP address 163.61.188.9. Detection metrics show 8 of 95 security vendors on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 1 out of 100. The domain appears on one security blocklist and has been referenced in four threat intelligence pulses within AlienVault OTX. The SSL certificate was issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to phishing sites. The page title, 'Problem loading page,' may have been used to disguise the site’s true purpose during initial deployment or as a fallback during takedown attempts. Current status confirms stglbk.live is offline, though the infrastructure remains a potential risk for reactivation. Organizations and individuals are advised to block the domain and associated IP address (163.61.188.9) at the network level. Users who may have interacted with the site should immediately reset credentials for any financial accounts accessed during the exposure window. Monitoring for related domains registered under the same registrar (Global Domain Group LLC) or resolving to the same IP range is recommended to preempt future campaigns. Financial institutions should alert customers to verify domain authenticity before entering login details, particularly for sites mimicking their branding.