{"success":true,"data":{"id":"crypto-staking-reward-claim","label":"Fake staking / yield farming / liquidity mining reward claim with a wallet-connect link to an off-brand or suspicious TLD domain — real staking rewards are claimed on-chain via the protocol's verified dApp, not via inbound email.","description":"Fake staking / yield farming / liquidity mining reward claim email with a wallet-connect link to an off-brand or suspicious TLD domain. \"Your staking rewards of $X are ready to claim — connect your wallet to receive your pending rewards now.\" The link resolves to a drainer site, commonly using suspicious TLDs (.xyz, .finance, .farm, .yield, .defi, .rewards, .earn, .stake, .token, .crypto, .web3, .dapp, .claim, .airdrop) or off-brand domains not matching any legitimate protocol. Real staking reward claims happen on-chain via the protocol's verified dApp UI (Lido, Rocket Pool, Curve, Convex, Yearn, Aave, Uniswap, Compound) — legitimate protocols never send email prompts to connect a wallet for reward collection. Detection: staking rewards/yield farming/liquidity rewards vocabulary + claim-now/connect-wallet urgency + off-brand or suspicious-TLD href + sender NOT on canonical protocol domain + no In-Reply-To + no List-Unsubscribe. Source: GC1-R17; Chainalysis crypto drainer report 2025; Certik staking phishing analysis.","tier":"warning","category":"scam","isThin":false}}