marktwx[.]cyou

This domain, marktwx.cyou, is identified as a phishing site impersonating the Plesk Obsidian 18.0.77 control panel interface. Analysis indicates the page title explicitly matches the legitimate Plesk Obsidian 18.0.77 release, suggesting an attempt to deceive system administrators or hosting clients into entering credentials. No direct evidence of a cryptocurrency drainer or payment skimmer was observed, but the domain aligns with credential harvesting tactics targeting infrastructure management platforms. The use of a legitimate-looking interface increases the likelihood of successful social engineering against technical users. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 12, 2026, through Dynadot LLC, an uncommon future date that may indicate registration data manipulation or a placeholder. It resolves to the IP address 37.77.150.150, geolocated to Russia under LLC Baxet. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. VirusTotal detection shows 20 out of 95 security vendors flagging the domain as malicious. The domain appears on three independent security blocklists and is actively blocked by at least three endpoint protection systems. No Google Safe Browsing (GSB) listing was confirmed at the time of analysis. The domain has been taken offline, reducing immediate exposure risk. However, the infrastructure remains registered and could be repurposed for future campaigns. The SSL certificate may still be valid, and the IP address has not been sinkholed or seized. Organizations are advised to add the domain and associated IP to internal blocklists, monitor for credential reuse attempts from affected user groups, and verify Plesk instances for unauthorized access. The future registration date warrants further scrutiny, as it may indicate an attempt to evade automated detection systems relying on domain age heuristics.