pc[.]ecmarketsck[.]com

Analysis indicates that pc.ecmarketsck.com was actively serving content associated with a generic phishing campaign before being taken offline. The domain resolves to 104.21.44.179, an address owned by Cloudflare (AS13335) located in the United States. Registration was performed through Gname.com Pte. Ltd. on February 8, 2026, and the site presented the page title “EC markets”. Technical fingerprinting shows the use of Ant Design, Vue.js, Cloudflare Browser Insights, and HTTP/3, all served behind Cloudflare’s edge network.

Detection data reveal that three independent security blocklists have listed the domain, and three anti‑phishing products—PhishDestroy, MetaMask, and SEAL—have explicitly blocked it. VirusTotal scans show five of ninety‑four antivirus engines flagging the host, confirming a malicious reputation. The current offline status suggests the operators have either aborted the campaign or are rotating infrastructure, but the historical indicators remain relevant for threat‑intel correlation. Defenders should continue to block the domain at the network perimeter and update any URL filtering rules to include it.

Continuous DNS monitoring is advisable to detect any re‑registration or rapid IP changes that could signal a resurgence. Given the Cloudflare hosting, sinkholing the IP is not feasible, so reliance on external blocklists and endpoint detection remains the primary mitigation. Analysts should retain the observed indicators—domain name, IP address, registrar, page title, and detection counts—in threat‑intel feeds to support future attribution and pattern matching.