flr[.]stakingreward[.]app

This domain is flagged as a high-risk brand impersonation site specifically targeting Gmail users. Analysis indicates the infrastructure was designed to deceive victims into believing they are interacting with legitimate Google services, facilitating credential theft through fraudulent login interfaces. The threat type is confirmed as brand impersonation, with a focus on harvesting sensitive account information from unsuspecting users. Infrastructure analysis reveals multiple red flags: the domain flr.stakingreward.app was registered on December 27, 2025, through Dynadot LLC, an uncommon registrar for Google-related services. It resolves to the IP address 142.250.193.196, which is associated with AS15169 Google LLC, suggesting an attempt to blend into legitimate traffic or exploit perceived trust in Google's infrastructure. The domain lacks an SSL certificate, a critical omission for any site handling credentials. Security vendors on VirusTotal flagged this domain at a rate of 18/95, indicating moderate to high confidence in its malicious nature. It appears on one security blocklist and was actively blocked by PhishDestroy. The page title 'Google' further confirms the intent to impersonate Gmail's login interface. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address across all network security controls. Organizations should deploy email and web filtering rules to prevent users from accessing or being redirected to flr.stakingreward.app. End-users who may have interacted with the site should be instructed to reset their Gmail credentials from a verified Google login page and enable multi-factor authentication. Security teams should monitor for indicators of compromise, such as failed login attempts or unusual account activity, originating from the IP 142.250.193.196. Given the domain's recent creation date and lack of SSL, additional scrutiny should be applied to similar domains registered through Dynadot LLC or resolving to Google-associated IPs.