register-stabilizerfinance[.]xyz

This domain, register-stabilizerfinance.xyz, is currently active and operates as a crypto drainer phishing site targeting users of decentralized finance platforms. Analysis indicates the site impersonates Stabilizer, a legitimate stablecoin decentralized exchange (DEX), by replicating its branding and presenting itself as a "Zero-Slippage Stablecoin DEX." The infrastructure is designed to deceive users into connecting cryptocurrency wallets, enabling unauthorized transactions that result in fund theft. Infrastructure analysis reveals the domain was registered on June 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.200.156, which hosts additional suspicious endpoints. The domain is flagged by 1 of 95 security vendors on VirusTotal and appears on four independent security blocklists, including MetaMask, PhishDestroy, SEAL, and ScamSniffer. Gridinsoft assigns the domain a trust score of 0 out of 100, further confirming its malicious classification. The page title, "Stabilizer | Zero-Slippage Stablecoin DEX," directly mirrors the branding of the legitimate Stabilizer Finance platform, increasing the likelihood of successful user deception. The domain remains active and poses an elevated risk to individuals engaging with decentralized finance protocols. Users are strongly advised to avoid interacting with register-stabilizerfinance.xyz and any associated links. Wallet providers and security platforms should update blocklists to include this domain and its resolving IP address. Organizations should monitor for connections to 172.67.200.156 and investigate any interactions with the domain in network logs. Users who may have connected wallets to this site should immediately revoke access via their wallet settings and transfer assets to a new, secure wallet address.