nytostaked[.]info

This domain, nytostaked.info, is flagged as a brand‑impersonation site targeting Binance users with a wallet/seed phishing campaign. Infrastructure analysis shows the domain is hosted on Cloudflare’s network (ASN 13335) and resolves to the IP address 172.67.172.16, which is located in the United States. The domain is configured with Cloudflare name servers (hal.ns.cloudflare.com, margot.ns.cloudflare.com) and does not present an SSL/TLS certificate, indicating that HTTPS connections are not established. Registration information reveals the domain was purchased through Dynadot Inc., a registrar commonly used for both legitimate and malicious registrations. Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist, currently listed by PhishDestroy.

VirusTotal scans have identified the domain as malicious in 13 of 95 vendor engines, providing additional confirmation of its fraudulent nature. The only observed page element is the title “Home”, and no further page content has been captured because the site is marked as offline at the time of analysis. Uncertainty remains regarding the exact payload delivered to victims, as the offline status prevents direct inspection of the landing page, login forms, or any embedded scripts. The lack of an SSL certificate also limits the ability to observe encrypted traffic that might be used to exfiltrate credentials. Consequently, defenders cannot confirm the specific techniques employed beyond the high‑level classification of wallet/seed phishing.

Defensive recommendations include adding nytostaked.info to URL filtering and DNS‑based blocklists across enterprise gateways, ensuring that any outbound connections to the IP 172.67.172.16 are logged and, if possible, denied. Continuous monitoring of Cloudflare‑hosted domains that resolve to the same IP range is advised, as threat actors frequently rotate domains on this infrastructure.