birb-staked[.]xyz

The domain birb-staked.xyz was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare‑owned address 104.21.69.48 (AS13335, United States). The site presents the page title “Birb Website” but no further content has been captured, and the domain has been taken offline at the time of this report. Infrastructure analysis shows the domain is protected by Cloudflare, employing HSTS, HTTP/3, and Cloudflare Browser Insights, and presents a TLS certificate issued by Google Trust Services (WE1). Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 / 100, three independent blocklists have listed the domain, and it is actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal reports that eight of ninety‑three security vendors flag the domain as malicious, reinforcing the suspicion of abuse. The threat classification supplied is a crypto scam, specifically a crypto drainer, indicating attempts to illicitly acquire cryptocurrency assets from unsuspecting users. While the exact phishing payload or wallet addresses have not been observed, the combination of a low trust score, multiple vendor detections, and blocklist presence provides concrete evidence of malicious intent.

Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any resurgence of the hostname, and consider adding the IP address 104.21.69.48 to threat intelligence feeds. Because the site is hosted behind Cloudflare, attribution to the underlying operator is obscured, so threat hunters should focus on traffic patterns to the Cloudflare edge and correlate any wallet interaction logs with known phishing campaigns. Ongoing vigilance is recommended until the domain is permanently retired from active use.