marsmarket[.]info

Analysis of marsmarket.info indicates an active generic phishing infrastructure. The domain was registered on June 8, 2026 through Dynadot Inc and is hosted on a Hostinger Germany server (IP 92.113.23.212, DE location). Nameservers point to ns1.dns-parking.com and ns2.dns-parking.com, and the site serves an HTTP 200 response over a Let's Encrypt R12 certificate, confirming TLS availability. Detected technologies include PHP, Hostinger CDN, and HTTP/3, suggesting a standard web‑hosting stack rather than a specialized phishing kit. Mail exchange is handled by mx1.hostinger.com (priority 5) and mx2.hostinger.com (priority 10). The domain appears on a single security blocklist and is listed in four AlienVault OTX pulses. VirusTotal scans show four of ninety‑one security vendors flagging the host, reinforcing the malicious assessment. PhishDestroy has already blocked the domain, but its continued resolution to the same IP confirms the infrastructure remains live. No page content, brand target, or specific phishing landing page details are available, so the precise victim lure cannot be determined at this time. Defenders should add the IP address 92.113.23.212 and the domain marsmarket.info to outbound and inbound blocklists, monitor DNS queries for the associated nameservers, and consider sinkholing the host to disrupt further activity. Ongoing observation is advised to capture any future changes to the site’s content or additional indicators.