camp[.]stakingrewards[.]biz

Analysis of camp.stakingrewards.biz reveals a credential phishing operation that targets Google users. The domain was registered on February 21, 2026 and resolves to the IP address 142.251.140.164, which belongs to ASN 15169 (Google LLC) and is geolocated in Germany. The hosting IP is owned by Google, a common tactic used to lend legitimacy to malicious pages. The site presented a page title of "Google," directly matching the advertised brand target, and the scam type is identified as credential phishing.

Security vendors have flagged the domain: fifteen of ninety-three VirusTotal scanners reported malicious activity, and the site appears on two independent blocklists, including PhishDestroy and ScamSniffer. A Gridinsoft trust score of 0 out of 100 further confirms the lack of any benign reputation. The SSL certificate is listed as "WE2," which does not correspond to a known trusted authority and may indicate a self‑signed or otherwise suspicious certificate. The domain’s current status is offline, suggesting that the operator has taken the site down, possibly in response to detection.

However, the underlying infrastructure—Google‑owned IP space and a convincing page title—remains a reusable vector for future impersonation attempts. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP for re‑use, and update detection rules to flag any new domains that resolve to the same IP range and use similar branding cues. Incident response teams should also advise users to verify URLs before entering credentials and to report any suspicious Google‑related login prompts to their security teams.