secta-market[.]vip

Analysis of secta-market.vip, created on February 21, 2026, shows a high‑risk phishing infrastructure still active as of July 24, 2026. DNS resolution points to IP address 144.124.255.94, which is registered to AS216071 SERVERS TECH FZCO in the Netherlands. The domain is hosted on an Nginx/OpenResty stack with HTTP Strict Transport Security enabled, and it serves a TLS certificate issued by Let’s Encrypt (certificate identifier E8). An HTTP 301 redirect is observed, and the page title returned from the server is identical to the domain name, providing no additional context about the intended victim or lure.

The domain’s nameservers are ns3.my-ndns.com and ns4.my-ndns.com, both associated with the registrar NiceNIC International Group Co., Limited. Reputation signals are uniformly negative: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on a single security blocklist, and PhishDestroy has listed it as blocked. VirusTotal scans report that two of ninety‑three security vendors flag the domain, reinforcing the suspicion of malicious use. No further public content or landing‑page analysis is available, leaving the exact phishing payload or credential‑harvesting mechanism unknown.

Defensive operators should immediately block secta-market.vip and its resolved IP 144.124.255.94 at perimeter firewalls, DNS resolvers, and proxy filters. Continuous monitoring of the associated IP range and the registrar’s name server set is advised, as the infrastructure could be repurposed for additional campaigns. Updating threat‑intel feeds with the observed indicators—domain, IP, SSL certificate details, and redirect behavior—will help downstream security products detect and mitigate related activity.