stake1204[.]com

Analysis of the domain stake1204.com indicates it was actively impersonating Coinbase as part of a cryptocurrency scam. Registered on January 1, 2026, through NiceNIC International Group Co., Limited, the domain resolved to a Cloudflare IP address (188.114.96.3) within AS13335, located in the United States. Nameservers were configured as dina.ns.cloudflare.com and ricardo.ns.cloudflare.com, consistent with Cloudflare's infrastructure. The SSL certificate was issued by WE1, a provider commonly observed in phishing campaigns. The domain was flagged by 16 of 93 security vendors on VirusTotal, and it appeared on two security blocklists, including PhishDestroy and ScamSniffer.

AlienVault OTX recorded the domain in one threat intelligence pulse, further corroborating its malicious classification. Gridinsoft assigned a trust score of 0/100, reflecting high confidence in its fraudulent nature. The page title, 'Your cash · Coinbase,' directly aligns with the targeted brand, reinforcing the impersonation theme. As of July 23, 2026, stake1204.com is offline, though its infrastructure remains documented in threat intelligence repositories.

Defenders should treat any future resolution or re-registration of this domain as suspicious. Organizations are advised to block the domain, its resolved IP, and associated nameservers at the network level. No evidence of a phishing kit or additional payloads (e.g., malware, credential harvesters) was present in the available data, limiting further technical attribution. The exact mechanics of the scam—such as whether it involved fake wallets, fraudulent withdrawals, or social engineering—remain unconfirmed due to the lack of live page analysis.