yield-stbl[.]com

This domain, yield-stbl.com, is flagged as an active staking scam phishing site targeting cryptocurrency users. Infrastructure analysis reveals it is hosted on Cloudflare infrastructure, resolving to the IP address 172.67.183.172 under AS13335. The domain was registered on November 26, 2025, through NiceNIC International Group Co., Limited, and uses Cloudflare nameservers (skip.ns.cloudflare.com and tori.ns.cloudflare.com). The SSL certificate is issued by Google Trust Services, which is consistent with legitimate services but does not mitigate the domain's malicious intent. The site is currently returning an HTTP 403 status with the page title 'Just a moment...', a common Cloudflare interstitial, which may indicate attempts to evade detection or restrict access to specific visitors. The domain appears on one security blocklist and is flagged by 3 out of 95 security vendors on VirusTotal, suggesting moderate but not universal detection. The scam classification as a 'Staking Scam' aligns with known patterns of fraudulent cryptocurrency platforms, though the exact content or mechanics of the scam are not confirmed due to the lack of direct access or additional forensic data. The use of Cloudflare Browser Insights and HTTP/3 further indicates an attempt to leverage modern web technologies to enhance performance and potentially bypass security measures. Defenders should treat this domain as high-risk and take immediate action to block access at the network level. The 403 status may indicate the site is selectively serving content, so monitoring for changes in HTTP responses or page titles is recommended. Given the domain's recent registration and association with a known scam type, it is likely part of an ongoing campaign. Additional investigation into related domains or IPs may uncover further infrastructure linked to this threat. No legitimate use case for this domain has been identified, and its continued operation suggests it remains a viable threat to users.