blocktrustmarkets[.]com

The domain blocktrustmarkets.com was registered on 13 February 2026 through Ultahost, Inc. It resolves to the IPv4 address 198.251.83.106, which is geolocated to the United States and tied to FranTech Solutions. Authoritative name servers are ns25.asurahosting.com, ns26.asurahosting.com, ns25.my-control-panel.com and ns26.my-co. The MX record is configured to point to blocktrustmarkets.com, and the site serves HTTPS using a Let’s Encrypt certificate valid for the current year.

Threat intelligence classifies the site as a generic phishing operation that mimics a Microsoft Exchange login portal. The page returns HTTP 200 responses, indicating an active web service. VirusTotal scans have flagged the domain in 14 out of 95 security engines, and the Gridinsoft trust score is 0 out of 100. The domain appears on a single security blocklist and has been added to the PhishDestroy feed, confirming its active status.

While the infrastructure details are concrete, the exact phishing landing page content and credential harvesting mechanisms have not been publicly disclosed. The presence of a valid SSL certificate reduces immediate browser warnings, which can increase user trust. No additional infrastructure such as command‑and‑control servers or malware payloads has been observed, suggesting the campaign relies solely on credential theft via the counterfeit Exchange interface.

Defenders should block DNS resolution for blocktrustmarkets.com and add the IP 198.251.83.106 to network deny lists. Email gateways should reject messages originating from the domain’s MX record, and web proxies should enforce SSL inspection to detect the counterfeit Exchange login. Continuous monitoring of the associated name servers and rapid ingestion of any new indicators into security telemetry will help contain this high‑risk phishing operation.