dmarkuet[.]com

Analysis of dmarkuet.com indicates a brand impersonation campaign targeting Celer, active since February 21, 2026. The domain was registered through Web Commerce Communications Limited (WebNic.cc) and uses nameservers ns100.webnic.cc and ns101.webnic.cc. Infrastructure resolves to 185.149.120.225, an IP address hosted by DDOS-GUARD LTD (AS57724) in Russia. As of July 23, 2026, the domain is offline, though it previously displayed a generic 'Website Created' page title with no further content analysis available. The domain appears on one security blocklist and is flagged by PhishDestroy.

Seven of 93 security vendors on VirusTotal detect dmarkuet.com as malicious, though the specific detection rules or payloads remain unconfirmed. The SSL certificate (R11) provides no additional brand verification, and no phishing kit or redirect chain has been identified in available data. The registration pattern—using a registrar commonly associated with low-cost bulk domains—and hosting on a bulletproof provider align with known phishing infrastructure tactics. Defenders should treat this domain as part of a broader impersonation threat targeting Celer users.

While the site is currently offline, the infrastructure (nameservers, IP, registrar) may be reused for future campaigns. Network-level blocking of 185.149.120.225 and monitoring of newly registered domains under WebNic.cc nameservers are recommended. No evidence links this domain to credential harvesting, payment fraud, or other specific attack vectors beyond brand impersonation. Further analysis of historical content or redirect behavior would require archived captures or additional telemetry.