login-stokr[.]com

The domain login-stokr.com was observed hosting a credential‑phishing page that mimics an investor dashboard for the brand STOKR, as indicated by the page title “Investor dashboard • STOKR”. The site was registered on 21 November 2025 through NiceNIC International Group Co., Limited and uses Cloudflare’s DNS service (adelaide.ns.cloudflare.com, ignacio.ns.cloudflare.com). DNS resolution points to IP address 104.26.12.50, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate was presented, meaning the site operated over plain HTTP.

Automated analysis on VirusTotal recorded five detections out of ninety‑five AV engines, and the domain appears on a single security blocklist. Gridinsoft assigned a trust score of 0 / 100, and the phishing‑filtering service PhishDestroy has already blocked the domain. The infrastructure was taken offline at the time of this report (25 July 2026), and no current HTTP response could be retrieved. Evidence confirms that the domain is a credential‑phishing vector targeting investors or potential STOKR users, but the exact phishing kit, payload, or compromised accounts remain unknown because the site is no longer reachable.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same hostnames or IP address, and add the domain to internal blocklists. Because the domain leverages Cloudflare’s shared hosting, future malicious actors could reuse the same IP range, so threat‑hunters should watch for similar patterns in newly registered domains that resolve to Cloudflare IPs and employ the same nameservers. Ongoing reconnaissance of the registrar NiceNIC may also reveal additional related registrations. Organizations that use STOKR‑related credentials should instruct users to verify URLs carefully and enforce multi‑factor authentication to mitigate credential reuse risks.