unlockstake[.]net

This domain unlockstake.net is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting the Ethereum brand. The site presents the page title “Stake Ethereum with UnlockStake,” indicating an attempt to lure victims into a crypto‑scam. Registration details show the domain was created on 01 August 2025 via NiceNIC International Group Co., Limited. The authoritative DNS records point to carrera.ns.cloudflare.com and kyree.ns.cloudflare.com, and the domain resolves to IP 172.67.143.180, which belongs to AS13335 in the United States. An HTTP 307 redirect is observed, and the site serves a TLS certificate issued by Google Trust Services under the WE1 profile. Infrastructure analysis reveals the use of AngularJS, jQuery (served from a CDN), and HTTP/3 support. The domain appears on one security blocklist and has been blocked by PhishDestroy. VirusTotal scans show that 2 of 95 security vendors flagged the domain, and the Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. While the exact payload or credential‑harvesting mechanisms have not been publicly disclosed, the combination of brand impersonation, crypto‑related page title, and low trust scores indicates a likely phishing or fraudulent staking operation. Defenders should add unlockstake.net to blocklists at network and endpoint layers, monitor DNS queries for the associated nameservers, and enforce TLS inspection to detect the 307 redirect. Incident response teams should also correlate any internal logs of connections to 172.67.143.180 with user activity and consider user‑education messages warning against unsolicited staking offers referencing “UnlockStake.”