eul[.]stakingrewards[.]biz

Analysis of eul.stakingrewards.biz shows that the domain was registered on 21 February 2026 and is presently taken offline. The sole page title retrieved during investigation was “Google”, matching the declared brand target of Google and confirming that the site was intended to impersonate that brand. DNS resolution points to IP 142.251.179.104, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The TLS certificate presented is identified as “WR2”, a known certificate that does not provide any indication of malicious infrastructure beyond the domain itself.

The site was flagged by PhishDestroy and appears on a single public blocklist, indicating that at least one anti‑phishing feed has added it to its watchlist. VirusTotal scans returned detections from 12 of 93 security vendors, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, and the overall scam type is listed as Credential Phishing. The elevated risk rating aligns with the combination of brand impersonation, low trust score, and multiple vendor detections.

Uncertainty remains regarding the full payload delivered to victims, as no HTTP response codes, content snapshots, or additional infrastructure such as command‑and‑control servers have been published. Defenders should add eul.stakingrewards.biz to internal blocklists, monitor outbound traffic for connections to 142.251.179.104, and enforce strict credential‑reuse policies for Google accounts. Organizations using Google services should also inform users about the recent impersonation attempt and encourage verification of URLs before entering credentials. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related indicators.