stonkbroker-io[.]pages[.]dev

Analysis indicates that the domain stonkbroker-io.pages.dev has been observed in phishing campaigns targeting users seeking investment opportunities. The domain is hosted on the Google Cloud Pages service, as indicated by the .pages.dev suffix, which provides free static web hosting. The site was submitted to PhishDestroy and has been blocked by that service. Additionally, it appears on one public security blocklist, confirming that at least one external feed has flagged it as malicious.

VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation engines; none of the engines reported a detection at the time of the scan, but the absence of detections does not constitute confirmation of safety. No public Safe Browsing, Open Threat Exchange, or registrar WHOIS details have been disclosed in the available intelligence, and no SSL certificate attributes, HTTP response codes, or page‑title information are currently available for assessment. Infrastructure analysis reveals no further IP address or autonomous system data. Consequently, the confidence in the domain’s benign status remains low, and the risk rating remains under investigation.

Threat actors may leverage the domain to harvest credentials or redirect victims to further malicious infrastructure. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor DNS queries for stonkbroker-io.pages.dev, and consider adding it to internal blocklists. Continuous re‑evaluation is recommended as additional telemetry becomes available, particularly any changes in detection vendor scores, new blocklist listings, or observed malicious payloads associated with the domain.