echo[.]markroah[.]com

The domain echo.markroah.com is currently classified as a high‑risk phishing infrastructure delivering a fake‑airdrop campaign. The site is actively serving content as indicated by its HTTP 308 response and retains a valid TLS certificate issued by Let’s Encrypt (R12). The page title returned by the server is "Echo", which aligns with the limited metadata available.

Infrastructure analysis shows the domain resolves to the IPv4 address 76.76.21.142, hosted in the United States and associated with Vercel, Inc. Authoritative name servers are evangeline.ns.cloudflare.com and porter.ns.cloudflare.com, both belonging to Cloudflare’s DNS network. Registration occurred on 24 April 2026 through Name.com, Inc. The domain’s Gridinsoft trust score is 0 out of 100, and it appears on three independent security blocklists, where it is actively blocked.

The observed threat vector matches a known “Airdrop Scam” phishing kit, which typically lures victims with promises of free token distributions. The kit’s presence, combined with the high‑risk rating and the active status flag, suggests the site is being used to harvest credentials or cryptocurrency wallet information. No detections were reported on VirusTotal at the time of analysis (0/95), but the absence of detections does not imply benign behavior given the other indicators.

Defenders should prioritize immediate containment of traffic to echo.markroah.com. Recommended actions include adding the domain to outbound deny lists, enforcing DNS sink‑holing for its associated IP address, and monitoring TLS certificate changes for potential re‑issuance. Continuous re‑evaluation is advised, as the site may evolve or adopt new payloads. Correlation with internal logs for any authentication attempts to "Echo" or related airdrop terminology will aid in identifying compromised accounts.