stakeaffilates12[.]com

This domain, stakeaffilates12.com, is actively flagged as a crypto drainer phishing site targeting users of the Stake platform's affiliate program. Analysis indicates the domain was registered on June 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 172.67.162.242, hosted on Cloudflare's network (AS13335). The page title, 'Stake — Affiliate - Laravel,' directly mimics legitimate Stake affiliate portal branding, suggesting an attempt to deceive users into interacting with fraudulent cryptocurrency transaction interfaces. Infrastructure evidence reveals the domain is protected by Cloudflare nameservers (carol.ns.cloudflare.com and tanner.ns.cloudflare.com) and uses a Google Trust Services SSL certificate (WE1). While the domain is blocked by at least one security vendor (PhishDestroy) and appears on one security blocklist, detection remains limited, with only 1 out of 95 security vendors on VirusTotal flagging it as malicious. This low detection rate may indicate either a new or highly targeted campaign, or the use of evasion techniques to bypass automated analysis. The domain's registration age (25 days old at the time of this report) and its active HTTP 200 status suggest ongoing malicious operations. Defenders should treat this domain as a high-risk crypto drainer, particularly given its direct impersonation of a known cryptocurrency platform's affiliate program. Network-level blocking of the domain and its resolving IP (172.67.162.242) is recommended, along with monitoring for related domains using similar naming patterns or Cloudflare-hosted infrastructure. Endpoint protection systems should be updated to detect and prevent connections to this domain, and users should be alerted to verify the authenticity of any Stake-affiliated links before interacting with them.