mar1111[.]foundation
Phishing and security check for mar1111.foundation
PhishDestroy first observed mar1111.foundation on Nov 17, 2025. Stored page analysis classifies the content as nft scam. Current evidence score: 65/100 (high).
Positive findings are stored from 2 sources: VirusTotal and Spamhaus DBL. VirusTotal recorded 4 detections among 95 engines: CyRadar, ESET, SOCRadar, ThreatHive on Feb 23, 2026 at 06:47 UTC. Spamhaus DBL: DBL_SPAM on Jul 14, 2026 at 18:31 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:30 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:33 UTC.
HTTP 502 was recorded on Aug 7, 2026 at 01:20 UTC; content was unavailable. Registration records for the domain list Web Commerce Communications Limited as the registrar and Sep 13, 2025 as the creation date. At collection time, the hostname resolved to 185.245.34.139 on AS400992 (ZHOUYISAT-COMMUNICATIONS, VI). The recorded endpoint location is Fremont, US. The stored server header is nginx/1.24.0 (Ubuntu). DOM analysis on Mar 11, 2026 at 09:23 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 2 visual captures from PhishDestroy and URLScan; no page title was retained, so the captures preserve the landing-page appearance. TLS metadata lists E7 as the certificate issuer with validity through Dec 12, 2025; checked Mar 11, 2026 at 12:48 UTC.
The content indicators and 2 positive source findings support the current nft scam classification.
Network Security Intelligence
Threat Response Pipeline
Public Blocklist Status
Stored Capture
Domain Intelligence
Technical detailsDNS, SSL SANs, timestamps
ICANN OVERSIGHT
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
VirusTotal Analysis
Archived Evidence
Evidence & External Reports
Were You Affected by This Site?
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive