test[.]eddx[.]io

PhishDestroy identifies test.eddx.io as an active generic phishing domain potentially mimicking financial or login portals to harvest user credentials. This domain was flagged due to its suspicious infrastructure despite low VirusTotal detections, indicating it may evade initial detection mechanisms. The domain resolves to IP 172.67.200.158, registered through GoDaddy.com, LLC on April 20, 2023, and currently operates with a Google Trust Services SSL certificate. VirusTotal shows 9/95 detections, suggesting it is not yet widely recognized as malicious by antivirus engines. This domain poses a targeted threat to users who interact with it, particularly if it impersonates legitimate services such as email providers, banking platforms, or e-commerce sites. The infrastructure (GoDaddy hosting, Cloudflare IP resolution) suggests a deliberate attempt to obscure malicious intent while leveraging reputable service providers. The lack of detections on VirusTotal (9/95) may indicate a low-profile campaign or recent deployment, increasing the risk of successful phishing attempts. Security researchers note that such domains often appear transient, making immediate action critical to prevent further exploitation. Users who visited test.eddx.io should immediately cease any interaction and scan their devices for malware or unauthorized access. If credentials were entered, change passwords immediately and enable multi-factor authentication on all associated accounts. Report the domain to your organization's security team or through platforms like Google Safe Browsing, PhishTank, or VirusTotal to aid in blocking efforts. Avoid revisiting the site and warn others who may have encountered it. Proactive monitoring of financial accounts is recommended to detect any signs of credential theft or fraudulent transactions.