stakingsrewards[.]pro

Analysis on stakingsrewards.pro as of July 24, 2026 indicates the site was operating as a Google brand impersonation campaign. The domain resolved to IP 142.250.185.164, which is allocated to AS15169 Google LLC in the United States, suggesting the attacker leveraged a legitimate Google address to increase credibility. The TLS certificate presented by the site was issued by Google Trust Services under the WE1 branch, further aligning the visual cue with the targeted brand. DNS records show the domain is registered through Cloudflare, Inc., with authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and the underlying web server advertised Cloudflare and HTTP/3 support. The page title returned by the server was the single word “Google,” matching the declared brand target. Reputation services have flagged the domain across multiple vectors.

Four independent security blocklists list stakingsrewards.pro as malicious, and the domain is blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. On VirusTotal, 11 of 95 scanning engines reported the site as malicious, reinforcing the suspicion. The Gridinsoft trust score is 0 out of 100, indicating an extremely low trust rating. The overall risk assessment is high, and the site is currently offline, which may be a temporary takedown or an evasion tactic. The convergence of these artifacts—brand‑matching title, Google‑issued TLS certificate, and placement on multiple blocklists—provides strong evidence that the domain was deliberately crafted to deceive users seeking Google services.

Given the convergence of brand‑specific indicators, a legitimate‑looking certificate, and the use of a Google‑owned IP address, defenders should treat stakingsrewards.pro as a confirmed brand‑impersonation threat. Recommended actions include adding the domain to URL filtering policies, blocking the associated IP range, and monitoring for new domains that resolve to the same IP or use similar Cloudflare nameservers.