fil[.]stakingrewards[.]biz

Analysis of fil.stakingrewards.biz, created on 21 February 2026, shows that the domain was used for a crypto‑related fraud campaign that impersonates the Synapse brand. The site presented the page title “Filecoin Onchain Cloud,” suggesting an attempt to lure victims with a Filecoin or cloud‑based offering. The domain resolves to the IPv6 address 2606:4700:3030::ac43:92d1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The SSL certificate listed as “WE1” was observed, indicating that HTTPS was available at the time of capture. Reputation data is uniformly negative: the domain appears on one security blocklist and is flagged by PhishDestroy as malicious.

Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating. VirusTotal scans returned 12 positive detections out of 95 security vendors, confirming that multiple scanners consider the domain malicious. The overall risk level is elevated, and the current operational status is offline, suggesting the operators have taken the site down, possibly after detection. Despite the offline status, the observable infrastructure remains relevant for defenders.

The use of a Cloudflare‑provided IP can obscure the true origin of the actors, but the association with a known blocklist and the low trust score provide reliable indicators for detection. No additional public blocklists, Safe Browsing entries, or Open Threat Exchange references were found in the supplied intelligence, leaving the broader distribution of this infrastructure uncertain. Defenders should continue to block the domain and the associated IPv6 address at perimeter and DNS filtering layers, monitor for any re‑registration attempts, and consider adding the observed SSL fingerprint to TLS inspection policies. Ongoing vigilance is advised because the operators may recreate the campaign under a different domain while retaining the same branding and hosting patterns.