wlfi[.]stakingsrewards[.]club

The domain wlfi.stakingsrewards.club was registered on 21 February 2026. DNS resolution points to 142.251.140.164, an address announced by AS15169 Google LLC and geolocated to Germany. Hosting on a Google‑owned IP range is a common tactic for brand‑impersonation campaigns because it can lend perceived legitimacy and evade simple network‑based blocking. The site presented a page title of “Google”, and the threat classification identifies it as a credential‑phishing operation targeting the Google brand.

The SSL certificate associated with the domain is identified as “WE2”, indicating a publicly trusted certificate that further masks malicious intent. VirusTotal analysis shows that 16 out of 93 scanning engines flagged the domain, confirming malicious behavior observed by multiple vendors. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service, which specializes in phishing takedown. The current online status is reported as offline, suggesting the payload may have been removed or the operators have temporarily withdrawn the site.

Evidence confirms the use of a legitimate cloud provider, a brand‑matching page title, and a trusted TLS certificate, all of which are consistent with a credential‑phishing campaign. However, the exact content served, the phishing kit employed, and the full list of victim‑targeted URLs remain unknown because the site is no longer reachable. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurrection of the host, and include the IP address 142.251.140.164 in reputation‑based filtering despite its legitimate ownership. Additional hunting should focus on other subdomains under the same registrar that may share the same hosting pattern, and on any outbound traffic to Google‑related services that could indicate compromised credentials being exfiltrated.