stader-app[.]net

Analysis of stader-app.net shows a recent registration (19 November 2025) and immediate deployment of infrastructure consistent with a brand‑impersonation operation targeting the Stader brand. The domain resolves to 188.114.97.3, an address owned by Cloudflare (AS13335) and served through Cloudflare‑provided nameservers (maciej.ns.cloudflare.com, saanvi.ns.cloudflare.com). The site presented an SSL certificate issued by Google Trust Services under the WE1 label, confirming a valid TLS termination but offering no indication of legitimate ownership. HTTP/3 support was detected, a common feature of modern Cloudflare‑fronted sites.

The observed page title, "www.www.stader-app.net", does not reveal any functional content and the site is currently taken offline, limiting real‑time observation. Reputation signals are strongly negative: Gridinsoft assigned a trust score of 0 / 100, and four of ninety‑five VirusTotal security vendors flagged the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed, reinforcing the classification as a brand‑impersonation scam. Registration was performed through NiceNIC International Group Co., Limited, a registrar often used for rapid, low‑cost domain acquisition.

While the offline status prevents immediate payload analysis, the combination of a fresh registration, Cloudflare fronting, a Google‑issued certificate, low trust score, and multiple vendor detections suggests a purposeful attempt to harvest credentials or otherwise exploit users familiar with the Stader brand. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of activity, and add the domain to internal threat intel feeds.