rlq8yo5as[.]noqucij[.]lol

This domain, rlq8yo5as.noqucij.lol, was registered on 25 February 2026 through NameCheap, Inc. The authoritative name servers are dns1.registrar-servers.com and dns2.registrar-servers.com. DNS resolution points to the IPv4 address 192.64.119.254, which belongs to AS22612 operated by Namecheap, Inc., and is geolocated in the United States. The site presented a page titled “Staking,” but no TLS certificate was observed, indicating that the service was delivered over plain HTTP. Automated scanning by VirusTotal recorded eight detections out of ninety‑three scanners, and Google Safe Browsing flagged the domain for social‑engineering content. The domain appears on three external blocklists and is specifically listed by PhishDestroy, MetaMask, and SEAL as a malicious resource.

As of the report date, the domain has been taken offline. The available evidence confirms a high‑risk phishing infrastructure targeting users with a “Staking” lure, likely intended to harvest credentials or private keys. However, the precise payload, victim interaction flow, and any associated command‑and‑control servers remain unknown because the site is no longer reachable for direct analysis. No additional indicators such as malicious scripts, redirects, or compromised assets have been published.

Defenders should block any outbound traffic to 192.64.119.254 and add rlq8yo5as.noqucij.lol to local DNS deny lists. Security appliances that reference the three known blocklists, as as well as the PhishDestroy, MetaMask, and SEAL feeds, will already detect the domain, but explicit rule creation ensures coverage if those feeds are delayed. Monitoring for similar “Staking” page titles in new domains registered with the same registrar or name‑server pattern may provide early warning of related campaigns. Incident response teams should also review recent credential‑theft alerts for potential exposure linked to this domain, given its confirmed phishing classification.