stakeeth[.]cfd

PhishDestroy identifies stakeeth.cfd as an active crypto-drainer domain designed to steal cryptocurrency. The site impersonates Stake ETH, a legitimate Ethereum staking platform, and employs a crypto-drainer kit to siphon funds from unwitting victims’ wallets. The malicious domain was registered through Dynadot LLC and resolves to IP 188.114.97.3. Security analysis shows this domain has been active since May 23, 2025, with additional indicators pointing to a drainer kit that automates unauthorized wallet connections and token transfers.

This domain was flagged by 2 out of 95 security vendors on VirusTotal, indicating limited but present detection coverage. The site operates with a Google Trust Services SSL certificate, which may lend an air of legitimacy to unsuspecting users. The domain is registered with Dynadot LLC, a common registrar used by malicious actors due to its low barriers and minimal vetting. With its recent creation date of May 23, 2025, and zero entries on Google Safe Browsing (GSB), stakeeth.cfd remains under the radar of major blocklists. Current evidence suggests this is part of an emerging campaign targeting Ethereum users, particularly those engaged in staking activities.

As of the latest analysis, stakeeth.cfd is confirmed active and poses an elevated risk to cryptocurrency users. Immediate user action is advised to avoid interaction with this domain or any linked payment pages. PhishDestroy recommends using verified tools and browser extensions to check domain reputation in real time. While some security vendors have begun flagging this domain, detection gaps remain, emphasizing the need for proactive verification. The combination of a recent domain, low blocklist coverage, and crypto-drainer functionality creates a dangerous threat profile that requires heightened awareness and caution from the crypto community.