stake[.]lidk[.]fi

The domain stake.lidk.fi was registered through Key-Systems GmbH and first appeared in the WHOIS record on May 26, 2026. DNS resolution points the hostname to the single IPv4 address 104.21.94.176; attempts to retrieve authoritative nameserver records returned no results, indicating that nameserver information is currently unavailable. The domain is listed on one public security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, suggesting that at least one defensive organization has identified malicious activity associated with the host.

VirusTotal reports that the domain has been scanned by 91 security vendors, none of which raised a detection. While the lack of vendor detections does not constitute proof of benign intent, it confirms that the domain has attracted the attention of automated analysis platforms. The threat classification attached to the infrastructure is “crypto drainer,” implying that the domain is likely used to solicit cryptocurrency payments under false pretenses, though no additional payload or phishing page details have been publicly disclosed.

The current operational status is marked as active, and the risk level remains under investigation, indicating that the full scope of the campaign has yet to be determined. Defenders should continue to monitor DNS and network traffic for connections to 104.21.94.176, enforce blocklist rules that already flag stake.lidk.fi, and consider adding the domain to internal deny lists. Because the site’s content and SSL characteristics have not been publicly documented, further passive and active probing—subject to appropriate legal and policy constraints—is recommended to confirm the presence of malicious endpoints and to collect any additional indicators of compromise.