stake[.]lidi[.]fi

The domain stake.lidi.fi was registered through Key-Systems GmbH on May 26, 2026. Within weeks of its creation it began appearing on two security blocklists and has been actively blocked by the PhishDestroy and ScamSniffer services. DNS resolution points the domain to the IP address 172.67.171.104, which is currently hosting the malicious payload. VirusTotal analysis shows that 12 of 91 scanned security vendors flag the domain as malicious, reinforcing the classification of a crypto‑drainer operation.

The threat is enumerated as a high‑risk, active crypto drainer, and the unique seed identifier for this incident is 3cfd83. Existing intelligence does not disclose additional infrastructure such as ASN, country, or SSL certificate details, and no page title or content analysis has been published. Consequently, the confidence in the domain’s malicious intent rests on the registrar information, blocklist presence, vendor detections, and the observed IP address. Defenders should immediately add stake.lidi.fi to deny‑list rules across firewalls, proxy devices, and endpoint protection suites.

Network monitoring should include alerts for outbound connections to 172.67.171.104, and DNS logging should flag any resolution attempts for the domain. Because the domain is newly created, threat‑intel feeds should be refreshed frequently to capture any emerging indicators, and any internal communications that reference cryptocurrency transactions should be inspected for potential compromise. Continuous correlation with the 12 vendor detections on VirusTotal will help validate future changes in the domain’s reputation. Until additional analysis is performed, the domain remains classified as a high‑severity crypto‑drainer and should be treated accordingly.