stake-nura[.]web[.]app

This domain, stake-nura.web.app, operates as a crypto drainer designed to siphon cryptocurrency from connected wallets by exploiting malicious smart contracts or phishing for seed phrases. Analysis indicates the site employs JavaScript-based wallet interceptors to capture transaction signatures, redirecting funds to attacker-controlled addresses without user authorization. The threat specifically targets users of decentralized finance platforms, leveraging social engineering tactics such as fake token airdrops or liquidity pool scams to prompt wallet connections. Infrastructure analysis reveals the domain was registered through Google LLC (Firebase) on February 21, 2026, and currently resolves to the IP address 199.36.158.100, hosted on AS54113 (Fastly, Inc.) in the United States. Security vendor detections on VirusTotal show 3 out of 95 engines flagging the domain as malicious, while it appears on 5 independent security blocklists. The SSL certificate is issued by Google Trust Services (WR4), a common characteristic of Firebase-hosted domains, which may lend false legitimacy to the site. Users who interacted with stake-nura.web.app should immediately revoke any wallet permissions granted to the domain via their wallet provider’s interface. All connected wallets should be treated as compromised; funds must be transferred to new, secure wallets with fresh seed phrases. Browser extensions or applications used during the interaction should be scanned for malware, and transaction histories reviewed for unauthorized transfers. The unique seed df70ae may correlate with additional malicious infrastructure; network-level blocking of the domain and its resolving IP (199.36.158.100) is recommended for enterprise environments.