livepeerstake[.]com

livepeerstake.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare’s network (ASN 13335) in the United States. The domain resolves to 172.67.134.89 and is served behind Cloudflare’s edge with HTTP/3 enabled. An HTTPS connection presents a certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS chain. HTTP requests receive a 307 temporary redirect response, a pattern often used by malicious operators to forward victims to malicious payloads while preserving the original URL. The site’s only visible attribute is the page title “Livepeer - Homepage”, which suggests an attempt to impersonate the legitimate Livepeer project. The domain is classified as a crypto scam, specifically a crypto drainer, and appears on the PhishDestroy blocklist.

VirusTotal analysis shows that two of ninety‑three security vendors flagged the domain, reinforcing the suspicion. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. Infrastructure analysis indicates no additional hosting beyond Cloudflare; the nameservers rudy.ns.cloudflare.com and ryleigh.ns.cloudflare.com are standard Cloudflare delegations. No evidence of alternative services, compromised servers, or unrelated infrastructure has been observed. The short age of the domain—less than five months—combined with the low trust score and limited detection coverage suggests a deliberate, rapidly deployed campaign targeting cryptocurrency users.

Uncertainty remains regarding the exact content served after the 307 redirect, as the page has not been captured in detail. Analysts cannot confirm whether the landing page hosts malicious scripts, wallet‑draining code, or social engineering forms. Defenders should block the domain at network perimeter, add it to URL filtering and DNS sinkhole lists, and monitor for outbound traffic to the resolved IP.