marchfour[.]icu

The domain marchfour.icu is currently flagged as an active phishing host with an elevated risk rating. Defensive feeds indicate that the domain has been blocked by the PhishDestroy network, suggesting that at least one reputable anti-phishing service has identified malicious activity associated with the host. VirusTotal analysis shows that three out of ninety‑one scanning engines have returned a positive detection, confirming that the domain exhibits characteristics typical of phishing infrastructure, though the majority of scanners have not flagged it. Additionally, the domain appears on a single security blocklist, reinforcing the notion that it has been observed in malicious traffic or reported by an external sinkhole.

No public data is available regarding the registrar, registration date, IP address, hosting provider, SSL certificate details, HTTP response codes, Safe Browsing status, or Open Threat Exchange (OTX) entries. Consequently, the precise technical footprint of the site—such as its underlying server location, certificate validity, or page title—remains undocumented in the current intelligence set. The limited detection coverage (3/91) implies that the phishing payload may be using evasion techniques that bypass many conventional scanners, or that the malicious content is transient and only triggered under specific conditions.

Defenders should therefore treat any traffic to marchfour.icu as suspicious and enforce blocking at the network perimeter. Organizations are advised to add the domain to internal URL filtering lists, update endpoint protection signatures to include the three detecting vendors, and monitor for any outbound connections that may indicate credential harvesting attempts. Continuous re‑evaluation is recommended, as additional detection signals may emerge if the campaign expands or if further scanning engines acquire evidence of malicious behavior.