ecomine-global[.]us

On July 23, 2026, the domain ecomine-global.us was observed to be hosted behind Cloudflare (AS13335) at IP 104.21.28.196. The site presented the page title “Home | Ecomine Global” and was protected by a Let's Encrypt certificate (R13). Infrastructure analysis shows the domain was registered on February 21, 2026 and uses the authoritative nameservers ns15.my-control-panel.com and ns16.my-control-panel.com. DNS queries return an MX record pointing to ecomine-global.us with priority 0, indicating the domain also accepts mail traffic. The web server runs LiteSpeed and serves content built with Bootstrap, includes the Smartsupp live-chat widget, Lightbox scripts, and supports HTTP/3.

The site is currently taken offline, and the blocklist PhishDestroy has listed it as malicious. Independent scanning on VirusTotal returned 15 positive detections out of 93 security vendors, confirming that multiple anti-malware services consider the domain malicious. Additionally, the domain appears on one external security blocklist, reinforcing its risk profile. While the page title and hosting details are known, the specific phishing payload, targeted credentials, or victim interaction flow have not been publicly disclosed, leaving the exact attack vector uncertain.

Defenders should block network traffic to both the domain and its resolved IP address, add the domain to internal DNS blocklists, and monitor for any email messages using the listed MX record. Because the domain leverages a reputable CDN, threat hunting should also consider other domains sharing the same Cloudflare edge IP range. Continuous re-scanning of the domain is recommended in case it re-appears online, and any observed login attempts or credential submissions should be treated as compromised. Organizations using email filtering should ensure the MX record is denied, and endpoint protection should be updated to include the 15 VirusTotal detections associated with this host.