stakingsrewards[.]biz

Analysis of the domain stakingsrewards.biz indicates a high-risk brand impersonation operation targeting Google. The domain, registered on November 23, 2025, through Dynadot LLC, was flagged by multiple security vendors and blocklists prior to being taken offline. As of July 23, 2026, the domain resolves to the IP address 142.251.40.164, which is associated with AS15169 (Google LLC) in the United States. This IP resolution is unusual for a phishing domain, as it points to legitimate Google infrastructure, though it does not confirm the hosting environment was controlled by the threat actor. The domain lacks an SSL certificate, increasing the likelihood of interception or detection by network security tools.

The page title captured from the site was 'Google,' aligning with the reported brand impersonation. No evidence of a phishing kit or specific scam mechanism (e.g., credential harvesting, malware distribution) is available in the current data. The domain appears on four security blocklists, and 18 of 95 security vendors on VirusTotal flagged it as malicious. Detection engines including PhishDestroy, Polkadot, Enkrypt, and Codeesura have classified this domain as part of a brand impersonation campaign. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification.

Nameservers for the domain are hosted on Cloudflare (alexa.ns.cloudflare.com and randall.ns.cloudflare.com), a common tactic to obscure hosting origins and improve resilience against takedowns. The current offline status suggests intervention by registrars, hosting providers, or security teams, though the domain remains registered and could be reactivated. Defenders should monitor for re-emergence under the same or similar domains, particularly those leveraging Cloudflare nameservers or resolving to unexpected IP ranges. Network security teams are advised to block the domain and IP at perimeter defenses, and to review logs for prior connections to 142.251.40.