night[.]stakingsreward[.]art

Analysis of night.stakingsreward.art shows a confirmed credential‑phishing infrastructure targeting Google users. The domain was registered on February 21, 2026 and promptly began serving a page whose HTML title is "Google", indicating a direct brand impersonation. DNS resolution points to IP address 142.251.12.99, which belongs to AS15169 Google LLC and is geolocated in Singapore, suggesting the attackers are leveraging legitimate cloud resources to host the malicious page. The site presented an SSL certificate labeled "WR2", a detail that aligns with other observed phishing kits but does not provide a trusted chain.

Security telemetry records that the domain was blocked by the PhishDestroy sinkhole and appears on one external security blocklist, confirming that at least one defensive feed recognized the activity. VirusTotal analysis shows ten of ninety‑three scanning engines flagged the domain, providing independent corroboration of malicious intent. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low reputation.

The site’s current status is offline, indicating that the operators have taken the host down or have moved to a new location. While the exact landing page content and credential‑capture mechanisms have not been captured, the combination of brand impersonation, malicious SSL, low trust score, and multiple vendor detections establishes a high confidence that the domain was used for credential phishing against Google accounts. Defenders should ensure that night.stakingsreward.art is added to URL filtering and host‑based blocklists, monitor for any re‑registration or similar sub‑domains under the stakingsreward.art zone, and consider broader threat‑intel sharing of the IP address 142.251.12.99 in case of repeated abuse of Google‑owned infrastructure for phishing campaigns.