marketcorecap[.]com

Analysis indicates that marketcorecap.com was registered on 27 March 2025 through Cosmotown, Inc. and resolved to the IPv4 address 23.95.132.226, which belongs to AS36352 operated by HostPapa in the United States. The domain employed the authoritative name servers ns4.zillionkinghost.com and ns3.zillionkinghost.com. A TLS certificate labelled “R11” was observed, confirming that HTTPS was available at the time of collection. The site was identified as a social‑media phishing campaign that impersonates Facebook, as reflected in the intelligence tag “brand impersonation” and the scam type “Social Media Phishing.” The page title returned by the server, “Pi Blockchain, Community & Developer Platform | Pi Network,” does not contain any Facebook branding, suggesting that the malicious landing page may have been repurposed or that the content was not captured before the takedown.

VirusTotal scans returned 10 positive detections out of 93 engaged scanners, indicating that multiple anti‑malware engines flagged the domain as malicious. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 / 100, reinforcing the low reputation assessment. Current host status is reported as offline, and no active HTTP response was observed at the time of analysis.

Defenders should immediately add marketcorecap.com and its resolved IP 23.95.132.226 to network denial lists and configure web‑proxy rules to block any TLS handshake attempts to the host. Monitoring of the registrar Cosmotown, Inc. for future domains using the same name‑server pair is advisable, as the combination of zillionkinghost.com name servers and HostPapa hosting has previously been associated with credential‑stealing infrastructure. Since the page title references a cryptocurrency project unrelated to Facebook, security teams should also watch for potential re‑use of the domain in other thematic campaigns.