ecudecode[.]mx

The domain ecudecode.mx, now offline, impersonates the brand Linea to conduct phishing activities. With 13 out of 93 vendors on VirusTotal flagging it as malicious, this domain has been identified as a significant threat. It is also listed on two public blocklists: PhishDestroy and CryptoFirewall. The domain was registered via NEUBOX Internet SA de CV and hosted on IP 193.39.187.165 in the United States, under AS62164 Heymman Servers Corporation.

The phishing site, titled "ECUDECODE – Tienda en linea," attempted to deceive users by posing as a legitimate online store. The SSL certificate was issued by Let's Encrypt, a common choice for cybercriminals due to its free and automated nature. The domain was created on February 21, 2026, and PhishDestroy detected it five days later, on February 26, 2026. This rapid detection highlights PhishDestroy's capability to identify threats in the early stages of their lifecycle.

Despite its takedown, ecudecode.mx's initial success in avoiding detection underscores the persistent challenges in combating phishing attacks. The domain achieved a platform risk score of 83 out of 100, indicating a high level of threat potential. This case exemplifies the importance of early detection and intervention in preventing phishing scams from exploiting unsuspecting users. The swift action taken to take the site offline demonstrates the effectiveness of coordinated efforts between cybersecurity entities and hosting providers.