marriott-globalcareers[.]com

This domain is classified as a high-risk phishing site specifically targeting job applicants through fake Marriott careers portals. Analysis indicates the infrastructure was designed to harvest corporate credentials by mimicking legitimate employment application processes, a technique commonly associated with advanced persistent threat actors seeking initial access to hospitality sector networks. Infrastructure analysis reveals the domain marriott-globalcareers.com was registered on June 12, 2026, through Name.com, Inc., and resolved to the IP address 91.195.240.94. Security telemetry shows 16 out of 95 vendors flagged this domain on VirusTotal, while Google Safe Browsing classified it under SOCIAL_ENGINEERING. The domain appears on two security blocklists (PhishDestroy and InversionDNS) and received a 0/100 trust score from Gridinsoft. Current status indicates the domain has been taken offline, though residual DNS records may persist. Organizations should implement the following mitigation measures: block the domain and IP 91.195.240.94 at perimeter security controls, including firewalls and secure web gateways. Security teams should search historical logs for connections to this domain or IP, particularly from HR or recruitment systems. Employee training should emphasize verification of career portal URLs through official company channels before submitting applications. Domain monitoring services should add this domain to watchlists for potential re-registration attempts. Given the hospitality sector targeting, security teams should review recent job application submissions for signs of credential harvesting or follow-up social engineering attempts.