turtle[.]stakingsrewards[.]club

Analysis of the domain turtle.stakingsrewards.club indicates it was actively involved in credential phishing targeting Google users. The domain, registered on February 21, 2026, resolved to the IP address 192.178.155.104, which is hosted under AS15169 (Google LLC) in the United States. The page title was explicitly set to 'Google,' aligning with the identified brand impersonation. SSL certificate classification WR2 suggests a non-standard or potentially low-trust certificate, though further cryptographic details are unavailable.

As of the report date, the domain has been taken offline, though it remains listed on one security blocklist. Detection engines on VirusTotal flagged the domain as malicious, with 15 out of 93 security vendors marking it as phishing-related. The domain was blocked by PhishDestroy, indicating prior confirmation of its malicious intent. No additional details regarding the phishing kit, exact lure mechanisms, or user interaction flow are available, as the site content was not preserved for analysis.

Defenders should treat this domain as a confirmed phishing threat targeting Google credentials. Network-level blocks should be implemented for 192.178.155.104, and retrospective log analysis should be conducted to identify any prior connections from internal systems. Given the domain's association with Google's ASN, further investigation into potential abuse of cloud infrastructure is recommended. No evidence suggests persistence or lateral movement, but monitoring for related domains with similar naming patterns (e.g., 'stakingsrewards') may help preempt future campaigns.