marathonautoservices[.]com

marathonautoservices.com was registered on January 15, 2024 through Squarespace Domains II LLC. The authoritative nameservers are ns-cloud-b1.googledomains.com, ns-cloud-b2.googledomains.com and ns-cloud-b3.googledo, indicating use of Google Cloud DNS. The site presents a valid TLS certificate issued by Let’s Encrypt (R13) and returns HTTP 200 responses. DNS resolution points to IP address 156.67.74.121, which is hosted in the United States by AS47583 Hostinger International Limited. Infrastructure fingerprinting shows the web stack comprises WordPress backed by MySQL, running on LiteSpeed with PHP, and client‑side libraries including Underscore.js, jQuery and jQuery Migrate. Hostinger branding appears among the detected technologies.

The page title reported as “MARATHON AUTO” does not match the advertised target, but the campaign is classified as social media phishing that impersonates Facebook. Gridinsoft assigns a trust score of 0 out of 100, reflecting maximum suspicion. VirusTotal analysis records a single positive detection out of ninety‑five scanned security vendors, and the domain is listed on one public blocklist, specifically PhishDestroy, which currently blocks the host. The overall risk rating is high and the operational status remains active as of the report date, July 22, 2026.

Defenders should note that the combination of a reputable TLS certificate, a legitimate hosting provider, and a low detection count may allow the site to bypass some automated filters. Blocking at the DNS or IP level, enforcing URL filtering for the domain, and monitoring outbound connections to the identified IP are recommended mitigation steps. Continuous re‑scanning with multiple threat intelligence services is advised to capture any additional detections that may emerge. The lack of publicly disclosed content beyond the page title leaves the exact phishing payload unknown, so analysts should treat any communications referencing marathonautoservices.