stakingsrewards[.]sbs

Analysis of stakingsrewards.sbs confirms its classification as a brand impersonation phishing domain targeting Google. The domain, registered on November 17, 2025, through Dynadot LLC, was active until recently taken offline. Infrastructure analysis reveals Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and resolution to an IPv6 address (2a00:1450:4001:804::2004) geolocated in Germany under AS15169 (Google LLC). The page title 'Google' aligns with the confirmed brand target, though no SSL certificate was detected.

Detection data shows the domain was flagged by 14 of 95 security vendors on VirusTotal and appears on at least one blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0/100, further supporting its malicious classification. The domain's scam type is explicitly labeled as brand impersonation, with no evidence of additional payloads or specific phishing kit usage at this time. Defenders should treat this domain as confirmed malicious infrastructure.

The lack of SSL and its offline status suggest mitigation efforts may have disrupted its operation, but historical resolution data and registrar details should be incorporated into threat intelligence feeds. No evidence links this domain to other campaigns or threat actors beyond the Google impersonation context. Further analysis of associated IP ranges and registrar patterns may reveal additional related domains.