stake[.]lifo[.]fi

This report documents the current intelligence on stake.lifo.fi, a domain first observed on 26 May 2026 and flagged as a crypto‑drainer operation. Registration data shows the domain was created through Key‑Systems GmbH, a registrar that does not obscure registrant details. Technical resolution points to the IPv4 address 188.114.96.3; no nameserver records were returned in the query, indicating either a misconfiguration or use of obscure DNS services. The domain is listed on one public security blocklist and has been actively blocked by the PhishDestroy sink‑filtering service.

VirusTotal indicates the domain was submitted to 91 scanning engines, none of which raised a detection at the time of analysis; this absence of alerts should not be interpreted as a safety indicator. No SSL/TLS certificate information, HTTP status codes, or page‑title metadata are presently available, and Safe Browsing or Open Threat Exchange (OTX) feeds have not reported additional sightings. Consequently, the observable attack surface is limited to the domain name, its registration record, and the hosting IP. The lack of publicly disclosed payload, phishing page samples, or command‑and‑control (C2) endpoints leaves the full modus operandi uncertain.

Defenders should treat stake.lifo.fi as a high‑confidence indicator of a crypto‑drainer campaign and consider immediate mitigation steps: add the domain and its resolving IP to DNS‑based blocklists, enforce outbound traffic restrictions to the IP range, and monitor internal DNS logs for any resolution attempts. Continuous re‑assessment is advised, as future VirusTotal scans, blocklist updates, or threat‑intel sharing may reveal additional artifacts. Until more detailed forensic evidence is obtained, the domain remains under active investigation.