stakegame[.]fr

Stakegame.fr is currently listed as offline but remains a high‑risk crypto‑drainer infrastructure. The domain was registered on 23 February 2026 through AMEN / Agence des Médias Numériques and resolves to the IP address 87.106.242.99, which belongs to AS8560 IONOS SE in Germany. The hosting provider and the German location are consistent with other recent Gambler‑Scam kits observed in the region. The site served no SSL certificate and returned an HTTP 404 status, indicating that the malicious front‑end has been removed or taken down.

The page title that was observed before takedown – “Stake Casino en ligne et Paris Sportifs - Jouez et Pariez en ligne” – aligns with the Gambler Scam kit identified in the intelligence, confirming that the domain was being used to lure victims into a cryptocurrency‑draining narrative targeting users of the Stake gambling platform. VirusTotal recorded a single positive detection out of 93 scanners, and the domain is listed on three independent blocklists. Additional defensive feeds have already flagged the host: PhishDestroy, MetaMask, and SEAL have added the domain to their blocklists, providing immediate protection for users of those services. The authoritative nameservers are ns1.amenworld.com and ns2.amenworld.com, which may be reused for future malicious registrations.

At present the only confirmed indicators are the hosting IP, the registrar, the observed page title, and the single VirusTotal hit; no further payload samples or credential‑harvesting pages have been released. Defenders should proactively deny traffic to 87.106.242.99 and to stakegame.fr at DNS and firewall layers, ensure that endpoint protection solutions incorporate the observed blocklist entries, and monitor for new domains registered with the same registrar or using the same nameserver pair. Continuous review of emerging Gambler‑Scam kit deployments is advised, as the threat actor may repurpose the infrastructure for additional crypto‑drainer campaigns.