stakingsreward[.]cyou

Analysis of stakingsreward.cyou, first observed on November 21 2025, shows a short‑lived infrastructure used to impersonate Google. The domain was registered through Dynadot LLC and delegated to the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to 142.250.186.164, an address owned by AS15169 Google LLC located in the United States. The HTTP response returned a page whose title is simply “Google”, and no TLS certificate was presented, indicating the site operated over plain HTTP only. Gridinsoft assigned a trust score of 0 / 100, and 15 of 95 VirusTotal scanners flagged the domain as malicious.

The site was added to a single external blocklist and subsequently taken down by the PhishDestroy takedown service; current status is offline. The threat is classified as a brand‑impersonation campaign targeting Google users, and the risk level is elevated. Evidence gaps include the exact content served, any credential‑harvesting forms, and whether the domain was used in conjunction with a broader phishing kit. No Safe Browsing or Open Threat Exchange entries are listed, and no additional hosting or CDN clues beyond Cloudflare are available. Defenders should immediately block stakingsreward.cyou at perimeter firewalls, DNS resolvers, and proxy filters.

Because the domain resolves to an IP owned by Google, network‑level alerts based solely on the IP may generate false positives; correlation with the specific host name is required. Continuous monitoring of the registrar Dynadot LLC and the associated Cloudflare nameservers for newly‑registered domains that resolve to the same IP range can help detect repeat infrastructure. Updating URL filtering feeds with the domain and the observed page title “Google” will reduce exposure to any re‑hosted copies. Organizations should also educate users that legitimate Google services always use HTTPS and present a valid certificate; any site lacking TLS should be treated as suspicious.