de-stakinowmention[.]info

The domain de-stakinowmention.info is presently taken offline, but historical evidence indicates it was used for wallet or seed credential harvesting. Infrastructure analysis shows the domain was registered through Cloudflare, Inc., and it resolved to the Cloudflare edge address 172.67.171.120, which belongs to AS13335 and is physically located in the United States. The site employed Cloudflare’s services, including HTTP/3, and presented a TLS certificate issued by Google Trust Services under the WE1 designation, confirming the use of a valid public‑key infrastructure despite its malicious purpose. Reputation signals are strongly negative: the domain appears on a security blocklist, was blocked by the PhishDestroy service, and is listed in a single AlienVault OTX pulse.

VirusTotal scans recorded six detections out of ninety‑five submitted engines, reinforcing the malicious classification. Scamadviser assigned a trust score of 1 out of 100, the lowest possible rating, and the site was identified as a wallet/seed phishing operation. No page title was captured, and no additional content details are available, leaving the exact landing page composition unknown.

Defenders should continue to block the domain at perimeter controls, monitor for any re‑registration attempts, and update detection rules to flag traffic to the associated IP address and Cloudflare name servers (ignat.ns.cloudflare.com, zara.ns.cloudflare.com). Because the TLS certificate is legitimate, reliance on certificate validation alone will not prevent exposure; instead, focus on reputation feeds, the observed VirusTotal detections, and the specific phishing classification. Incident response teams encountering credential submissions linked to this domain should treat them as compromised and advise affected users to rotate wallet seeds or credentials immediately.