zama[.]stakingsreward[.]art

The domain zama.stakingsreward.art was registered on February 21, 2026 and is presently taken offline following a takedown by PhishDestroy. Technical analysis shows the site presented a page title of "Google", indicating an explicit attempt to impersonate the Google brand. The domain resolves to IP address 142.250.80.68, which belongs to the AS15169 Google LLC network located in the United States. This IP association may be intended to lend credibility to the fraudulent page by leveraging a well‑known hosting prefix. The SSL certificate presented for the site is identified by the label WR2; no further certificate attributes are available, but the presence of HTTPS suggests an effort to appear legitimate.

VirusTotal scanning recorded 13 positive detections out of 93 security vendor engines, demonstrating that a subset of commercial and open‑source scanners recognized the domain as malicious. Additionally, the domain appears on one external security blocklist, confirming that at least one third‑party feed is already distributing its indicator. The threat is classified as brand impersonation targeting Google, and the elevated risk level reflects the high‑value nature of the victim brand and the use of a trusted hosting prefix. Defenders should update web‑filtering and DNS proxy rules to block zona.stakingsreward.art and any sub‑domains, even though the service is currently offline, to prevent potential re‑activation.

Threat‑intel platforms should ingest the IP 142.250.80.68 and the associated ASN as a suspicious indicator when observed in conjunction with brand‑impersonation payloads. Network monitoring should flag outbound TLS connections to this IP from internal hosts, as the certificate label WR2 may be reused in future campaigns. Organizations should also ensure endpoint protection solutions are aware of the 13 VirusTotal detections to improve detection of any related payloads that may be delivered via this infrastructure.