zen[.]stakingsrewards[.]club

Analysis indicates that zen.stakingsrewards.club was registered on 21 February 2026 and is currently taken offline. The domain resolves to 142.250.31.106, an address owned by AS15169 Google LLC in the United States, which suggests the attacker leveraged legitimate Google infrastructure for hosting. The page title returned by the server is “Google”, matching the declared brand target of Google and confirming a brand‑impersonation attempt. The site is classified as a credential‑phishing operation. VirusTotal records show that 14 of 95 scanning engines flagged the domain, providing independent confirmation of malicious intent.

The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy feed. The SSL certificate is identified as “WR2”, consistent with certificates observed on other fraudulent Google‑related sites. Gridinsoft assigned a trust score of 0 out of 100, indicating an extremely low reputation. No additional public intelligence, such as OTX or Safe Browsing entries, is available beyond the listed sources.

Uncertainty remains regarding the specific payload or credential collection mechanism, as the HTTP response body has not been disclosed and no sandbox analysis has been published. Defenders should continue to block the domain at perimeter controls, update internal blocklists with the observed IP address, and monitor for any future DNS resolutions that might point to the same infrastructure. Given the use of a Google‑owned IP range, organizations employing strict egress filtering should consider whitelisting only known Google services and applying more granular inspection for traffic to this address. Incident response teams should also advise users to verify any unsolicited Google‑branded communications through official channels, as the domain’s short lifespan and rapid takedown suggest a fast‑flux style campaign.