stvaults[.]net

This domain, stvaults.net, poses as an official Lido staking platform to deceive users into connecting cryptocurrency wallets or entering sensitive credentials. The site mimics legitimate staking services, specifically promoting "Earn stETH with Lido V3 Modular Staking Solutions," a fabricated offering designed to exploit trust in the Lido brand. Analysis indicates the site functions as a crypto drainer, where victims unknowingly authorize malicious transactions that transfer assets to attacker-controlled wallets. The risk is heightened by the use of professional design elements and technical infrastructure, including Cloudflare protections, to appear legitimate. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 4, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with phishing and fraudulent domains. Security vendors on VirusTotal flag the domain at 17/95 detections, with three major blocklists listing it as malicious. The site resolves to the IP address 188.114.96.3 and employs a Let's Encrypt SSL certificate, further obscuring its fraudulent nature. Additional technical indicators include the use of HTTP/3, HSTS, and Cloudflare Browser Insights, which are commonly leveraged to evade detection and enhance credibility. Users who have interacted with stvaults.net should immediately revoke any wallet permissions granted to the site. This can be done through wallet interfaces by reviewing and removing connected dApps or smart contract authorizations. All cryptocurrency assets should be transferred to a new wallet, as private keys or seed phrases may have been compromised. Monitor all linked accounts for unauthorized transactions and report the incident to relevant blockchain explorers or security platforms for further tracking. If credentials were entered, reset passwords and enable multi-factor authentication on all associated accounts. Given the domain's active status and high-risk classification, continued vigilance is advised, particularly for users engaged in staking or decentralized finance activities.