costadelmarshop[.]com

costadelmarshop.com was first observed on April 28, 2026 and is currently classified as a high‑risk generic phishing site. The domain resolves to the IPv4 address 196.196.232.66, which is mapped to a United States fiber‑grid network. The authoritative name servers are ares.trustname.com and zeus.trustname.com, both belonging to the registrar Fewmoretaps OU d/b/a Trustname.com. The site presents a valid Let’s Encrypt certificate (R13) but returns HTTP 500 for all requests, indicating that the malicious landing page is likely hidden behind server‑side errors. Infrastructure analysis shows a Gridinsoft trust score of 0 / 100, confirming the poor reputation of the host. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service. AlienVault OTX has indexed the domain in one threat‑intel pulse, and VirusTotal reports that three of ninety‑five scanners have flagged the host as malicious, providing additional corroboration of its abusive nature. The available evidence points to credential‑harvesting activity typical of generic phishing campaigns, although the exact payload and targeted brands cannot be confirmed because the site consistently returns a server error. The combination of a newly registered domain, low trust score, and alignment with known phishing infrastructure suggests an adversary is leveraging costadelmarshop.com as a disposable drop‑point for stolen login data. Defenders should add 196.196.232.66 and the domain costadelmarshop.com to outbound and inbound block lists, enforce TLS inspection to detect any attempted connections, and monitor email gateways for messages that reference the domain or its associated brand terms. Continuous re‑resolution of the domain is advised, as the underlying IP address could be changed to evade detection. Incident response teams should also query threat‑intel feeds for any new OTX pulses or VirusTotal updates that could reveal additional indicators of compromise.