bridge[.]stakingsrewards[.]club

bridge.stakingsrewards.club was registered on 21 February 2026 and is currently listed as offline. The site presented a page title of “Google”, matching the reported brand target, and is classified as a credential‑phishing campaign. Independent analysis shows that 14 of 93 VirusTotal scanners flagged the domain, indicating a moderate level of malicious detection across the ecosystem. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, reinforcing the assessment that it was used for malicious credential collection.

Network resolution points to IP address 142.251.208.4, which belongs to AS15169 owned by Google LLC in the United States; this overlap of malicious domain and legitimate Google infrastructure is a known tactic to increase trust and evade naïve filters. The SSL certificate presented is labeled “WE2”, but no further validation details are available, and the Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. While the HTTP service is no longer reachable, the historical evidence suggests the domain was actively serving content that mimicked Google login portals.

Because the domain is already offline, immediate mitigation focuses on updating local and network‑level blocklists, ensuring that any cached or previously resolved entries are purged, and reviewing authentication logs for possible credential submissions from the timeframe of February to the present. Defenders should also monitor for look‑alike domains that reuse the “stakingsrewards.club” suffix, as the naming pattern may be reused in future campaigns. Continuous scanning with multi‑vendor engines and inclusion of the domain hash in threat‑intel feeds will help prevent re‑exploitation.