edubridge[.]in[.]elixirgroup[.]com[.]au

The domain edubridge.in.elixirgroup.com.au is currently offline but exhibits multiple indicators of malicious activity consistent with a crypto‑related phishing campaign. Technical reconnaissance shows the domain resolves to the IPv4 address 108.167.183.73, which belongs to AS19871 Network Solutions, LLC and is geolocated in the United States. The authoritative name servers are ns8421.hostgator.com and ns8422.hostgator.com, confirming hosting under the HostGator infrastructure. No TLS certificate is presented for the site, and HTTP requests return a generic "503 Error" page title, indicating that the web service is unavailable or deliberately disabled. The domain was registered through Web Address Registration Pty Ltd, a registrar known to host a variety of legitimate and illicit sites.

Reputation services rate the domain extremely low: Scamadviser assigns a trust score of 1 out of 100, while Gridinsoft reports a score of 0 out of 100. The site is listed on a single security blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal scans have identified five detections out of ninety‑five scanners, reinforcing the suspicion of malicious intent. The intelligence labels the activity as a generic phishing operation with a specific crypto scam focus, and the risk level is elevated.

Because the site is already taken offline, immediate mitigation actions are limited to ensuring that any cached DNS entries or residual IP connections are purged from internal security controls. Defenders should continue to monitor the associated IP address and hosting provider for future domains that may reuse the same infrastructure, enforce strict outbound filtering for known crypto‑phishing indicators, and consider adding the IP and domain to internal blocklists. Evidence gaps remain regarding the exact payload or credential‑harvesting mechanisms, as no page content beyond the 503 title is available.