stake[.]liso[.]fi

Analysis of stake.liso.fi reveals that the domain was registered on 26 May 2026 through Key‑Systems GmbH. The authoritative name server lookup fails, returning NS_NOT_FOUND, which hampers typical DNS‑based reputation checks. The domain resolves to the IPv4 address 172.67.181.19, an address associated with Cloudflare’s edge network. Hosting on a shared CDN does not inherently indicate malicious intent, but it also obscures the underlying infrastructure and complicates attribution. The threat is classified as a crypto drainer, indicating that the site is likely used to solicit cryptocurrency transfers or private keys.

No public page title or content analysis is available, so the exact payload or luring technique cannot be confirmed. VirusTotal records show that the domain has been scanned by 91 vendors, none of which currently flag it as malicious. The absence of detections does not constitute a safety guarantee, especially given the recent creation date and the lack of historical reputation. The domain appears on a single security blocklist, specifically PhishDestroy, which has listed stake.liso.fi as malicious. Inclusion on this blocklist suggests that at least one security community has observed abusive activity linked to the domain.

No additional blocklists or Safe Browsing reports are documented. Given the combination of a newly created domain, lack of DNS name‑server data, resolution to a generic CDN address, and presence on a phishing‑focused blocklist, defenders should treat stake.liso.fi as potentially hostile. Recommended mitigations include adding the domain to outbound filtering rules, monitoring DNS queries for the IP 172.67.181.19, and employing URL‑reputation services that incorporate the PhishDestroy list. Continuous re‑evaluation is advised as further intelligence, such as sandbox analysis or user reports, becomes available.