xpl[.]stakingsrewards[.]club

The domain xpl.stakingsrewards.club was registered on February 21, 2026 and is currently listed as offline. Infrastructure analysis shows that the domain resolves to the IP address 142.251.140.164, which belongs to AS15169 Google LLC and is geolocated in Germany. The presence of a WE2 SSL certificate indicates that the site was served over HTTPS, but the certificate details have not been disclosed. The page title reported for the site is "Google," matching the declared brand target of Google and confirming the credential‑phishing intent.

The domain appears on a single security blocklist and is specifically blocked by the PhishDestroy filtering service. VirusTotal scans have recorded 14 detections out of 95 security vendors, reinforcing the malicious classification. Although the site is no longer reachable, the historical evidence suggests a short‑lived phishing campaign that leveraged a legitimate‑looking Google brand to harvest credentials.

Defenders should update their DNS and URL filtering policies to block the domain and the associated IP address, monitor for any future registrations that reuse the same sub‑domain pattern, and consider adding the IP to reputation‑based blocklists. Continuous monitoring of threat‑intel feeds for similar Google‑impersonation indicators is recommended, as the underlying infrastructure (Google‑owned IP space) could be reused by other actors. The limited detection footprint (one blocklist entry) does not diminish the risk; the confirmed brand impersonation and multi‑vendor detections warrant an elevated defensive posture until the domain remains offline.