e-coreinvest[.]org

The domain e-coreinvest.org was registered on March 10, 2026 and is currently active. Infrastructure analysis shows it resolves to the IPv4 address 163.61.188.2. The domain is served by four nameservers – dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, and dns4.lytehosting – indicating it is hosted on a shared platform provided by Lyte Hosting. Registration was performed through COSMOTOWN, INC., a registrar that has appeared in other low‑reputation registrations. Threat intelligence flags the domain as a generic phishing campaign; one of 91 security vendors on VirusTotal flagged the domain, and it appears on a single security blocklist.

PhishDestroy has already added e-coreinvest.org to its blocklist, confirming that known anti‑phishing services consider the domain malicious. No additional data such as SSL certificate details, HTTP response codes, page titles, or Safe Browsing verdicts are available, leaving the content of the site unverified. The limited detection footprint—one vendor flag and a single blocklist entry—does not diminish the risk, as the domain’s recent creation date and rapid deployment of phishing infrastructure suggest an active campaign. Defenders should immediately block e-coreinvest.org at DNS and proxy layers, add the IP address 163.61.188.2 to network‑level deny lists, and monitor outbound connections for any attempts to resolve or contact this domain.

Continuous scanning of the domain through sandbox or URL‑analysis services is recommended to capture any evolving payloads or credential‑harvesting pages. Because the registrar and hosting provider are publicly accessible, consider reporting the abuse to COSMOTOWN, INC. and Lyte Hosting to accelerate takedown efforts. Ongoing vigilance is required, as the lack of broader detection may indicate that the phishing site is still in a limited roll‑out phase.