wal[.]stakingsreward[.]art

Analysis of the domain wal.stakingsreward.art indicates a credential‑phishing campaign targeting Google users. The domain was registered on 27 December 2025 through Dynadot LLC and is currently taken offline. DNS resolution points to IP address 142.251.141.68, which belongs to AS15169 owned by Google LLC and is geolocated in Germany. The site presented the page title “Google”, matching the declared brand target and confirming the impersonation claim.

VirusTotal has recorded 15 detections out of 95 scanned security vendors, confirming that multiple scanners flag the host as malicious. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, demonstrating that at least one industry feed is already aware of the threat. An SSL certificate identified as “WE2” was observed, but no further certificate details are available. The limited public metadata suggests the infrastructure leverages legitimate Google‑owned IP space, a common tactic to increase trust and evade basic network filters.

Uncertainty remains regarding the full extent of the phishing payload, the hosting of any credential‑harvesting pages, and whether additional domains share the same infrastructure. Defenders should add the IP 142.251.141.68 to block lists for outbound connections when possible, monitor DNS queries for wal.stakingsreward.art, and enforce strict URL filtering for any pages presenting the Google brand. Continuous re‑inspection of VirusTotal and blocklist feeds is recommended to capture any re‑activation of the domain or emergence of related indicators.