allo[.]stakingrewards[.]biz

Allo.stakingrewards.biz was taken offline prior to the issuance of this report, limiting direct observation of its content. Intelligence indicates the site was launched on February 21, 2026 and presented a page title of "Google," explicitly targeting the Google brand. The domain was flagged by 13 of 95 security vendors on VirusTotal, indicating a moderate level of malicious detection across the scanning ecosystem. It appears on a single security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the view that it was being used for credential phishing against Google users.

Infrastructure analysis shows the domain resolves to the IP address 142.250.185.196, which is registered to Google LLC in the United States under ASN 15169. The use of a legitimate Google‑owned IP suggests the attacker leveraged legitimate hosting to increase the credibility of the malicious site. The SSL certificate associated with the domain is identified as "WE2," and the Gridinsoft trust score is recorded as 0 out of 100, reflecting a lack of trustworthiness in the certificate’s provenance.

The combination of brand impersonation, low trust score, and vendor detections points to a credential‑phishing campaign that likely harvested Google account credentials. Defenders should ensure that any DNS or firewall policies explicitly deny traffic to allo.stakingrewards.biz, monitor for related lookup patterns to the associated IP, and consider broader threat‑intel sharing of the domain’s indicators. Given the offline status, continuous re‑evaluation is advised in case the domain is re‑registered or the attackers shift to a new infrastructure.