Analysis of marmota.hostel.town indicates that the domain is currently active and resolves to the IPv4 address 172.86.104.14. The domain was submitted to VirusTotal where it was examined by 91 security vendors; none reported a detection at the time of scanning. Despite the lack of detections, the domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, confirming that it is being used in malicious activity.
A DNS query for authoritative name servers returned NS_NOT_FOUND, meaning the registrar information could not be retrieved and the nameserver configuration could not be verified. No WHOIS, SSL/TLS certificate details, HTTP status codes, page title, or content analysis have been released, leaving the hosting environment and the specific phishing kit employed unknown. The limited intelligence suggests a low-profile infrastructure that may rely on a transient or shared hosting arrangement, but the presence on a blocklist and the active block by PhishDestroy warrant immediate defensive action.
Defenders should add marmota.hostel.town to URL filtering and DNS block policies, consider blocking or monitoring traffic to the resolved IP address 172.86.104.14, and continue to track the domain for any changes in detection status on VirusTotal or additional blocklist listings. Ongoing observation of DNS query patterns and correlation with internal logs can help identify potential compromise attempts targeting users who might receive phishing communications referencing this domain.
ChainPatrol
Web-Check 
SOCRadar 
LeakIX 
