everstake[.]eu[.]com

The domain everstake.eu.com was registered on 21 February 2026 through Instra Corporation Pty Ltd. The registration uses the CentralNic name server set (ns1‑ns4.centralnic.net). The fully qualified domain name is hosted behind Cloudflare’s network (ASN 13335) and resolves to the IP address 172.67.219.15, which is located in the United States. Network probing returns an HTTP 521 response and a page title of “everstake.eu.com | 522: Connection timed out”, indicating that the origin server is currently unavailable while Cloudflare continues to proxy traffic. The TLS certificate presented is issued by Google Trust Services under the “WE1” designation, confirming that the connection is encrypted but does not validate the legitimacy of the site. Threat intelligence classifies the domain as a high‑risk cryptocurrency drainer. VirusTotal records a single positive detection out of ninety‑five scanners, and the domain appears on one external blocklist. Gridinsoft assigns a trust score of 0 out of 100, and PhishDestroy has already listed the domain as blocked. These indicators collectively suggest an active malicious campaign targeting cryptocurrency users, likely by luring victims to submit wallet credentials or transfer funds. Defenders should immediately block DNS resolution for everstake.eu.com and prevent outbound connections to its Cloudflare IP address 172.67.219.15. Logging should capture any HTTP 521 or 522 responses associated with the domain to identify compromised clients. Continuous monitoring of Cloudflare‑hosted assets for similar patterns is advised, and incident response teams should treat any related credential submissions as potentially compromised.