staketsone[.]cc

Analysis of staketsone.cc shows a short-lived crypto‑drainer infrastructure that was taken offline shortly after detection. The domain was registered on April 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare, using the nameservers nicole.ns.cloudflare.com and salvador.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to Cloudflare, Inc. in Canada and serves traffic over HTTP/3. The TLS certificate presented is issued by Google Trust Services, indicating a valid certificate chain but offering no assurance about the underlying content.

The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, consistent with its classification as a crypto‑drainer. VirusTotal recorded a single positive detection out of 94 scanned vendors, reinforcing the suspicion raised by the blocklists. The site’s current status is offline, and no live HTTP response or page title is available for further content analysis.

Defenders should continue to monitor any residual DNS entries for the IP 188.114.97.3, enforce outbound transaction controls to prevent unauthorized crypto transfers, and ensure that any internal security tooling references the known blocklist identifiers for staketsone.cc. Because the domain is already taken down, immediate containment actions are limited to updating blocklists, reviewing firewall rules for Cloudflare edge IPs, and verifying that no residual scripts or links remain in compromised assets. Ongoing vigilance is advised given the elevated risk rating and the rapid deployment pattern observed for this type of crypto‑drainer operation.