zeddex[.]io

Analysis of zeddex.io indicates that the domain is actively used for phishing. The domain was registered on February 21 2026 through NameCheap, Inc., and its authoritative name servers are dane.ns.cloudflare.com and dell.ns.cloudflare.com, confirming Cloudflare hosting. DNS resolution points to the IP address 104.21.70.241, which belongs to Cloudflare, Inc. in Canada. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, showing a valid HTTPS endpoint. HTTP requests are answered with a 301 redirect, a common technique for traffic steering.

VirusTotal reports that eight of ninety‑three scanning engines have flagged the domain, indicating that multiple security products have identified malicious behavior. Independent phishing‑specific blocklists, including PhishDestroy and ScamSniffer, have listed the domain, and it appears on two additional security blocklists. Gridinsoft assigns a trust score of 0 / 100, reflecting an extremely low reputation. The combined evidence points to a high‑risk, active phishing infrastructure. Uncertainty remains regarding the specific payload or credential‑stealing page, as no page title or content analysis is available in the current data set.

The lack of publicly disclosed malware families or command‑and‑control indicators limits attribution, but the presence of multiple detections and blocklist entries suggests a coordinated campaign rather than an isolated test. Defenders should block or sinkhole traffic to 104.21.70.241 and add zeddex.io to DNS and URL filtering policies. Monitoring for newly observed subdomains or similar Cloudflare‑hosted IPs is advised, as threat actors often rotate endpoints. Incident response teams encountering credential submissions to this domain should treat them as compromised and advise affected users to reset passwords. Continuous re‑evaluation is recommended, given the domain’s recent creation date and active status.