marsmarket[.]pro

PhishDestroy identifies marsmarket.pro as a credential theft site designed to harvest Cloudflare login credentials. The domain displayed a fake Cloudflare verification page titled 'Checking your browser before accessing. Just a moment...' to trick visitors into entering their credentials. This threat is part of a broader campaign targeting users of Cloudflare services, with the stolen information likely used for further phishing attacks or account takeovers.

Technical analysis reveals that the domain was created on June 8, 2026, through Dynadot Inc, and resolves to IP 92.113.23.62. Its SSL certificate is issued by Let's Encrypt (R12), which is common for phishing sites due to its free and automated issuance. VirusTotal data shows that 4 out of 95 security vendors flagged this domain as malicious, and it appears on 1 security blocklist. Additionally, AlienVault OTX recorded the domain in 4 threat intelligence pulses, indicating active monitoring by the security community. The domain is now offline, but its short lifespan and rapid takedown suggest it was used aggressively.

If users visited marsmarket.pro and entered any credentials, they should immediately change their Cloudflare passwords and enable two-factor authentication. They should also monitor their accounts for suspicious activity and consider reporting the incident to Cloudflare support. PhishDestroy recommends running a full security scan on any device that accessed the site to check for malware or unauthorized access. Staying vigilant against fake verification pages is crucial, as cybercriminals increasingly use such tactics to bypass security measures.