cards-staker[.]xyz

Analysis of cards-staker.xyz indicates this domain was actively involved in wallet and seed-phishing operations targeting Base users. The domain, created on September 3, 2025, and registered through NiceNIC International Group Co., Limited, resolved to IP 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335). No SSL certificate was present, increasing risk of unencrypted credential interception. The page title, 'Collector Crypt Gacha Machine,' suggests an attempt to lure users with a simulated reward or gaming mechanism, a common tactic in crypto-focused phishing schemes.

Multiple security vendors and blocklists have flagged this domain. Eight of 95 security vendors on VirusTotal detected malicious activity, while ScamSniffer and PhishDestroy both blocked it. Scamadviser and Gridinsoft assigned trust scores of 1/100 and 0/100, respectively, indicating high confidence in its fraudulent nature. The domain appeared on two security blocklists and was included in one AlienVault OTX threat intelligence pulse, reinforcing its classification as a confirmed phishing threat.

As of July 23, 2026, cards-staker.xyz is offline, though its infrastructure remains registered. Defenders should treat this domain as a known malicious indicator and block it at the DNS and network levels. Historical logs should be reviewed for connections to this domain, particularly from endpoints involved in cryptocurrency transactions. While the exact phishing kit or payload is not yet analyzed, the combination of brand impersonation, wallet phishing classification, and detection by multiple security tools confirms its role in credential and seed theft operations.