stockmarketcapital[.]org

stockmarketcapital.org was observed hosting a generic phishing page under the title “Stockmarketcapital – Build your future with Investments”. The domain was created on June 21, 2025 and registered through Atak Domain Bilgi Teknolojileri A._. DNS resolution points to the IPv4 address 107.173.193.235, which is allocated to AS36352 (HostPapa) in the United States. Authoritative nameservers ns1.bthostcloud.com and ns2.bthostcloud.com serve the zone, and the site does not present an SSL/TLS certificate, implying traffic was delivered over unencrypted HTTP.

Threat intelligence feeds have listed the domain on one security blocklist and the PhishDestroy feed has actively blocked it. A VirusTotal scan returned four positive detections out of ninety‑five antivirus and URL scanners, providing independent confirmation of malicious intent. Gridinsoft’s trust scoring system assigned a rating of 0 / 100, the lowest possible value, and the current operational status is reported as offline. The combination of a recent registration, low‑cost hosting provider, lack of encryption, and multiple vendor detections is consistent with infrastructure commonly used for credential‑harvesting campaigns targeting investors.

No further technical details such as the underlying phishing kit, form fields, or redirect behavior have been published, leaving the exact collection methodology uncertain. Defensive recommendations include immediate DNS or proxy denial of the domain, adding the associated IP address to blocklists, monitoring for re‑use of the hosting provider’s range, and capturing any future network traffic to enrich attribution. Continued observation of threat‑intel sources for related indicators will aid in early detection of any resurgence.