bob[.]stakingsreward[.]org

Analysis conducted on 23 July 2026 identifies bob.stakingsreward.org as a high‑risk brand‑impersonation infrastructure targeting Google. The domain was registered on 27 December 2025 through Dynadot LLC and resolves to IP address 142.251.140.164, which belongs to AS15169 Google LLC located in the United States. The domain is served from Cloudflare nameservers (alexa.ns.cloudflare.com and randall.ns.cloudflare.com) and does not present an SSL/TLS certificate, indicating that any web traffic would be delivered over plain HTTP. The page title returned from the site is simply “Google”, matching the declared brand target and confirming the intended impersonation. Google Safe Browsing classifies the URL as “social engineering”, and the domain appears on one external blocklist, where it has been flagged by PhishDestroy.

VirusTotal analysis shows that 16 of 93 security vendors have reported the domain as malicious, reinforcing the risk assessment. Gridinsoft assigns a trust score of 0 / 100, the lowest possible rating. The infrastructure is currently offline, but historical evidence suggests it was active prior to takedown. Defenders should continue to block the domain at perimeter defenses and update DNS‑based blocklists to include the observed IP address and the associated Cloudflare name servers.

Because the site lacks TLS, any interception attempts would be trivial, and the absence of a certificate should be treated as an additional indicator of malicious intent. Monitoring for future re‑registration of the same second‑level domain or similar look‑alike variants is advised. Analysts should also flag any email or web traffic that references the “Google” page title from this host, as it may indicate a continued phishing campaign. The lack of a live page prevents further content inspection, so additional telemetry should be collected if the domain resurfaces.