accurnulated[.]finance

The domain accurnulated.finance was registered on March 11 2026 through NameSilo, LLC and is presently taken offline. DNS resolution points to IP 104.21.32.36, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The authoritative nameservers are felipe.ns.cloudflare.com and harleigh.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. TLS termination is provided by a Google Trust Services certificate (WE1), indicating a valid‑looking HTTPS endpoint despite the malicious intent.

The site’s HTML title reads “Accumulated Finance – Omnichain Liquid Staking,” suggesting an attempt to lure victims interested in cryptocurrency staking services. VirusTotal analysis recorded a single positive detection out of 94 scanned engines, and the domain is listed on three public security blocklists. Additional blocking has been applied by PhishDestroy, MetaMask, and the SEAL consortium, reflecting recognition by both anti‑phishing and crypto‑wallet protection services. Evidence from these sources demonstrates that the domain was actively used for generic phishing, though the exact payload or credential‑harvesting page has not been disclosed.

Uncertainty remains regarding the scope of victim exposure, the presence of any compromised accounts, and whether the site was ever reachable before the offline takedown. Defenders should continue to block the domain at network perimeter and endpoint layers, enforce DNS filtering against the listed blocklists, and monitor for any residual traffic to the associated Cloudflare IP. Incident response teams should also check for any credential reuse patterns tied to the “Omnichain Liquid Staking” theme and advise users to validate URLs before entering wallet credentials. Ongoing threat‑intel feeds should be consulted for any re‑use of the same infrastructure in future campaigns.