moneytreestaking[.]xyz

Analysis of moneytreestaking.xyz confirms it as a wallet seed phishing domain targeting cryptocurrency users. The domain, registered on August 30, 2024, through HOSTINGER operations, UAB, was taken offline by July 24, 2026. Infrastructure analysis reveals it resolved to 35.157.26.135, hosted on Amazon.com, Inc. (AS16509) in Germany, with nameservers dns1-4.p01.nsone.net. No SSL certificate was detected, increasing susceptibility to interception.

The site was flagged by 11 of 95 security vendors on VirusTotal, though the absence of SSL and presence on a single blocklist (PhishDestroy) suggest limited detection coverage at the time of takedown. The page title 'Money Tree Staking' aligns with the classified scam type of wallet/seed phishing, indicating an intent to harvest cryptocurrency credentials. Defenders should treat this domain as compromised and prioritize blocking both the domain and its resolved IP in security controls.

The use of a major cloud provider (Amazon) for hosting is consistent with phishing campaigns leveraging reputable infrastructure to evade initial scrutiny. While the site is offline, historical DNS and WHOIS records should be preserved for forensic analysis, and any associated cryptocurrency addresses or wallets linked to this domain should be flagged for monitoring. The lack of SSL and minimal blocklist presence highlight the need for proactive threat hunting, particularly for domains registered through the same registrar or resolving to the same IP range.