stake[.]lieo[.]fi

Analysis of stake.lieo.fi shows a newly created domain (registered on May 26, 2026) that is currently active and associated with a crypto‑drainer threat profile. The domain is hosted on IP address 172.67.189.145, an address belonging to the Cloudflare network, which is frequently leveraged by threat actors to obscure origin infrastructure and to benefit from automatic TLS termination. Registration was performed through Key-Systems GmbH, a legitimate registrar, but the nameserver data returned as NS_NOT_FOUND, indicating that standard DNS records are not publicly resolvable or are being masked by Cloudflare's proxy service.

The domain has been flagged by PhishDestroy and appears on one external security blocklist, demonstrating that at least one independent threat‑intelligence source has identified malicious activity linked to this host. VirusTotal reports indicate that the domain was scanned by 91 security vendors, yet none of the engines raised a detection at the time of the scan; this absence of alerts does not constitute confirmation of safety, especially given the active blocklist entry and the specific crypto‑drainer classification. No additional contextual data such as SSL certificate details, page title, or HTTP response codes are available, limiting the depth of content‑level analysis.

Given the combination of recent registration, Cloudflare‑based hosting, blocklist inclusion, and the explicit crypto‑drainer label, defenders should treat stake.lieo.fi as high‑risk. Recommended mitigations include adding the domain to network‑level deny lists, enforcing DNS‑level blocking, monitoring outbound connections to the associated IP for anomalous traffic patterns, and correlating any internal logs that reference stake.lieo.fi with potential credential or wallet compromise events. Continuous re‑evaluation is advised, as further evidence may emerge from additional scans or threat‑intel feeds.