alfamart[.]online

Analysis of the domain alfamart.online, registered on April 16, 2026, confirms its classification as a phishing site with elevated risk. The domain was flagged by PhishDestroy and appears on one security blocklist. As of July 25, 2026, the site is offline, but prior infrastructure analysis reveals key indicators. The domain resolved to IP 84.32.84.80, located in Lithuania, and utilized Hostinger's CDN, as evidenced by the detected technologies (React, Hostinger CDN, HTTP/3) and nameservers (atlas.dns-parking.com, hyperion.dns-parking.com). The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites.

The page title, 'Hostinger Horizons,' suggests an attempt to mimic Hostinger's branding or services, though the exact content and target of the phishing campaign remain unconfirmed due to the site's current offline status. VirusTotal scans detected the domain as malicious by 2 of 94 security vendors, a low but non-zero detection rate that aligns with early-stage phishing operations. Trust scores from Gridinsoft (0/100) and Scamadviser (19/100) further indicate high risk. The domain was registered through HOSTINGER operations, UAB, and configured with MX records pointing to mx1.hostinger.com and mx2.hostinger.com, which may have been used to lend legitimacy or facilitate email-based phishing. No evidence of a specific phishing kit or targeted brand beyond the Hostinger-themed page title was identified in the available data.

Defenders should treat this domain as malicious and block it at the DNS and proxy levels. The use of Hostinger's infrastructure and CDN is notable, as it may complicate detection efforts by blending with legitimate traffic. While the site is offline, monitoring for reactivation or related domains with similar naming patterns, nameservers, or IP associations is recommended.