umbra[.]stakingsreward[.]art

The domain umbra.stakingsreward.art was observed targeting the Google brand by presenting a page title of “Google”. It was registered on December 27, 2025 through Dynadot LLC and is currently taken offline as of the report date July 23, 2026. DNS resolution points the domain to 142.251.163.104, an IP address owned by Google LLC (ASN 15169) located in the United States, a characteristic that can lend false legitimacy to the malicious site. The TLS certificate served is identified as “WR2”, which does not match any known Google‑issued certificate chain, indicating a rogue or self‑signed certificate.

VirusTotal scans have recorded 15 detections out of 93 security vendors, confirming that multiple scanners flag the domain as malicious. The domain appears on a single external blocklist and has been added to the PhishDestroy blocklist, demonstrating that at least one dedicated anti‑phishing service has taken action. The classified scam type is credential phishing, implying an attempt to harvest Google account credentials; however, no further details such as HTTP status codes, Safe Browsing verdicts, or Open Threat Exchange indicators were supplied, leaving the exact capture mechanism unverified. Defenders should immediately add umbra.stakingsreward.art to URL filtering rules and blocklists on perimeter firewalls, secure web gateways, and endpoint protection solutions.

Because the domain resolves to a legitimate Google IP, relying on IP reputation alone may be insufficient; domain‑based blocking is required. Continuous monitoring of DNS logs for queries to this FQDN is advised, and any authentication attempts to Google services from the same client should be investigated for possible credential compromise. Incident response teams should verify whether any compromised credentials have been used and enforce multi‑factor authentication for affected users.