staking-finary[.]com

The domain staking-finary.com has been confirmed as a cryptocurrency staking phishing endpoint. Analysis indicates the site was designed to impersonate legitimate staking platforms, likely targeting users of decentralized finance (DeFi) services. The domain is currently offline, but prior activity suggests it was actively used to harvest credentials or private keys under the guise of staking rewards or yield farming opportunities. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolved to the IP address 104.21.48.68 and was flagged by 5 of 95 security vendors on VirusTotal. The domain appears on three security blocklists, including entries from ScamSniffer, PhishDestroy, and OISD. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. The site employed Cloudflare for hosting and protection, utilizing HSTS, HTTP/3, and a Google Trust Services SSL certificate to mimic legitimacy. Current status indicates the domain has been taken offline, but residual risk remains for users who may have interacted with it prior to its deactivation. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. Users who accessed the site should revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Security teams should review logs for connections to 104.21.48.68 or the domain name to identify potential compromise. Proactive threat hunting for related infrastructure (e.g., Cloudflare-hosted phishing sites) is recommended to mitigate similar threats.