eedsrcyy[.]comwww[.]hzboligang[.]com

eedsrcyy.com was registered on 13 March 2026 through West263 International Limited and resolves to the IP address 172.247.146.162, which is owned by AS40065 CNSERVERS LLC in the United States. The domain uses four authoritative name servers (ns1‑ns4.myhostadmin.net) and presents a valid Let's Encrypt certificate (R13) that yields an HTTPS 200 response. These infrastructure elements are consistent with recent malicious provisioning campaigns that favor rapid deployment and cost‑effective hosting.

The public landing page returns the title “TP官方下载|TPWallet官网正版下载‑tp官网最新安卓版下载app|你的通用数字钱包”, indicating an attempt to masquerade as the TPWallet digital‑wallet service. The page content is delivered over TLS, but the site has been flagged by a single security vendor on VirusTotal (1/95) and appears on one external blocklist. Gridinsoft assigns a trust score of 0/100, and PhishDestroy has already added the domain to its block list, confirming a high‑risk classification as a generic phishing site.

Analysis shows no additional indicators such as known phishing kits, compromised credentials, or associated command‑and‑control infrastructure. The lack of broader detection may reflect the recent creation date and limited exposure. However, the presence of a brand‑specific title and the use of a trusted certificate suggest a deliberate attempt to gain user trust and harvest authentication details for TPWallet or related services.

Defenders should add 172.247.146.162 and the eedsrcyy.com domain to network‑level deny lists, enforce DNS filtering for the associated name servers, and monitor TLS certificate logs for similar Let's Encrypt issuances. End‑user awareness training must highlight the TPWallet brand spoofing observed in the page title, and any credentials submitted to the site should be considered compromised. Continuous threat‑intel feeds should be consulted for potential repurposing of the hosting infrastructure.