stablepay-register[.]com

PhishDestroy identifies stablepay-register.com as a live crypto drainer phishing domain currently under investigation for credential theft and fund siphoning. This domain impersonates StablePay’s registration portal with the intent to deceive cryptocurrency users into connecting malicious wallets or divulging private keys. The threat leverages brand imitation to exploit trust in legitimate payment gateways, potentially deploying drainer scripts to automatically transfer funds upon wallet connection. No confirmed drainer kit hashes or JavaScript payloads are publicly available at this time, but the infrastructure is consistent with known crypto-scamming toolkits. PhishDestroy analysts assess this as a high-risk operation pending sandbox detonation.

Technical indicators confirm an active threat: VirusTotal shows 0 detections out of 95 scanners as of latest checks. The domain resolves to IP 188.114.96.3, hosted on infrastructure linked to several crypto-scamming campaigns. Registered on April 15, 2026 — unusually recent for legitimate services — through NICENIC INTERNATIONAL GROUP CO., LIMITED. The site holds a valid Let’s Encrypt SSL certificate (CN: stablepay-register.com), likely to bypass browser security warnings. Google Safe Browsing (GSB) has not yet flagged this domain, and current blocklist coverage remains at zero, indicating rapid deployment and low prior detection. These factors suggest this is a newly activated campaign with minimal historical footprint.

Current status: active and operational, with no active takedowns or blocklists in place. Response actions are ongoing with hosting providers and domain registrars, but delays are expected due to offshore registration. Given the absence of detections, the risk to users remains elevated — particularly those searching for StablePay registration links. Users are advised to avoid this domain entirely and verify all URLs via official StablePay channels. Remaining risk is rated as high pending takedown success and increased detection coverage. Users should report this domain to PhishDestroy and their browser security extensions for accelerated blacklisting.