marketweb[.]biz

Analysis of marketweb.biz confirms its classification as an active phishing domain, operational since March 31, 2026. The domain is registered through Dynadot Inc and resolves to IP address 54.215.31.113, hosted on AWS EC2 infrastructure in the us-west-1 region. Nameservers ns1.dyna-ns.net and ns2.dyna-ns.net are associated with the domain, and it currently returns an HTTP 200 status, indicating an accessible web resource. Technical indicators reveal the use of Amazon ELB and Envoy for load balancing and proxy services, alongside Google Tag Manager and GeeTest, which may facilitate tracking and bot mitigation. The domain enforces HSTS and utilizes a Let's Encrypt SSL certificate (R12), suggesting an attempt to appear legitimate. However, the Gridinsoft trust score of 0/100 and presence on one security blocklist corroborate its malicious classification. Five of 94 security vendors on VirusTotal flag the domain, though the specific nature of the phishing content remains unconfirmed due to the absence of page-level analysis. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where financial credential harvesting poses a risk. The combination of cloud hosting, recent registration, and detected technologies aligns with common phishing infrastructure patterns. Further investigation into associated email addresses, SSL certificate reuse, or linked domains may uncover additional malicious assets.