dot[.]stakingsreward[.]art

Analysis as of July 23 2026 shows that dot.stakingsreward.art is an active brand‑impersonation site targeting Google credentials. The domain was registered on February 21 2026 and resolves to the IP address 142.250.185.100, which belongs to AS15169 Google LLC in the United States. The hosted server presents a valid SSL certificate labeled WE2, but the HTTPS handshake terminates on an IP owned by Google, a common tactic to lend legitimacy to fraudulent sites. The page title returned from the HTTP response is “Google”, matching the declared brand target.

Detection data indicate that 14 of 93 security vendors on VirusTotal flag the domain as malicious, and the site appears on a single external blocklist. PhishDestroy has explicitly blocked the domain, and Gridinsoft assigns a trust score of 0 out of 100, confirming a high confidence of abuse. The only identified scam category is credential phishing, suggesting the site attempts to harvest Google login details. Because the domain is currently marked offline, active exploitation is not observed, but the infrastructure remains in place and could be re‑activated.

Defenders should continue to enforce blocklisting of the IP address 142.250.185.100 and the domain itself in network firewalls, DNS filters, and endpoint protection suites. Monitoring for new DNS queries or TLS connections to the same IP or similar sub‑domains is recommended. Incident response teams should also verify that any internal Google‑related authentication flows are protected by multi‑factor authentication and that users are educated about unsolicited requests that reference the “Google” brand. No additional evidence such as OTX tags or Safe Browsing entries is available, so further investigation should focus on the observed indicators rather than speculative attribution.