stakestone[.]iostone[.]lodhapetro[.]com

On 24 July 2026 analysts observed the domain stakestone.iostone.lodhapetro.com, registered on 21 February 2026. The site is presently offline, but historical data indicate it was used for a crypto‑drainer operation, as reflected in the page title “StakeStone – Staking But More” and the classification “Crypto Scam”. DNS resolution points to the IPv6 address 2606:4700:3032::ac43:d695, which belongs to the Cloudflare network (AS13335) and is geolocated to the United States. The TLS certificate presented is identified as type E1, suggesting a standard level of encryption without additional validation.

The domain has been added to at least one security blocklist, specifically PhishDestroy, and appears on a single external blocklist. VirusTotal records show the URL was submitted to 93 scanning engines, none of which flagged the content at the time of analysis; however, the absence of detections does not constitute evidence of benign intent. No publicly available evidence describes the page’s HTML, login flow, or payload, and the current offline status prevents direct verification of malicious code. Uncertainty remains regarding the exact mechanisms employed to drain cryptocurrency assets, the extent of victim exposure, and whether additional infrastructure such as command‑and‑control servers is associated with the same IP range.

Defenders are advised to proactively block the IPv6 address and any sub‑domains under iostone.lodhapetro.com, incorporate the domain into local phishing and malware filters, and monitor for future registrations of similarly structured domains. Continuous re‑scanning on multi‑vendor platforms is recommended to capture any changes should the site become active again. Attribution to a specific threat actor cannot be confirmed without further forensic artefacts.