polkadot[.]stakingrewards[.]biz

Analysis of polkadot.stakingrewards.biz indicates that the domain was used for a credential phishing campaign targeting the Google brand. The site presented a page title of "Google," matching the declared brand target, and was classified as a credential phishing operation. Registrant information shows the domain was created on September 16, 2025 and was registered through Dynadot LLC. Infrastructure inspection reveals that the domain resolves to IP address 142.250.185.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The SSL certificate associated with the site is identified as "WE2," suggesting a self‑signed or low‑trust certificate.

Trust scoring from Gridinsoft assigned a score of 0 out of 100, reflecting a high confidence in malicious intent. The domain appears on two security blocklists, specifically PhishDestroy and ScamSniffer, and was flagged by 15 of 93 malware detection engines on VirusTotal. All available evidence points to an impersonation of Google to harvest user credentials, consistent with the documented scam type. The site has been taken offline, but historical observations indicate that it was actively serving phishing content before removal.

Defenders should continue to block the domain at network perimeter devices, update host‑based allowlists, and monitor for any residual traffic to the associated IP range. Because the domain leveraged a legitimate Google-owned IP block, additional scrutiny of traffic to AS15169 is advised to differentiate legitimate Google services from malicious reuse. Ongoing intelligence collection should focus on any resurgence of the domain or similar sub‑domains that may attempt to replicate this tactic.