stakingsrewards[.]cyou

This domain, stakingsrewards.cyou, was registered on 23 November 2025 through Dynadot LLC. The site presented a page title of “Google”, matching the declared brand target. No TLS certificate was observed, indicating that the service operated over plain HTTP. DNS resolution points to 142.250.185.228, an address announced by AS15169, which belongs to Google LLC in the United States. The use of Google‑owned infrastructure for a malicious brand‑impersonation campaign is a notable indicator of infrastructure abuse.

The domain is served by Cloudflare name servers (alexa.ns.cloudflare.com and randall.ns.cloudflare.com), a common choice for fast‑flux or proxying tactics. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis recorded six positive detections out of ninety‑five scanners, confirming that multiple security vendors have identified the domain as malicious. The domain appears on one external blocklist and has been actively blocked by the PhishDestroy mitigation service.

The current operational status is offline, suggesting that the hosting has been taken down or the site has been otherwise disabled. Given the observed indicators, defenders should continue to block stakingsrewards.cyou at DNS and proxy layers, monitor for any re‑registration attempts, and consider adding the IP address 142.250.185.228 to watchlists despite its legitimate ownership, as abuse of trusted infrastructure can be leveraged for future campaigns. Analysts should also flag the associated Cloudflare name servers for heightened scrutiny, and update any brand‑specific threat intelligence feeds for Google impersonation to include this recent artifact. Further investigation is required to determine whether additional sub‑domains or related payloads were deployed before takedown.