efk[.]au

Analysis of the domain efk.au indicates an active phishing infrastructure targeting users with a fraudulent login portal. Registered through DROP.com.au Pty Ltd, the domain remains operational as of July 26, 2026, returning an HTTP 200 status, confirming its accessibility. Infrastructure analysis reveals the domain is hosted on nameservers 3973.ns1.above.com and 3973.ns2.above.com, a pattern consistent with domains previously linked to phishing campaigns. The domain appears on one security blocklist and is actively blocked by PhishDestroy, further supporting its classification as malicious.

VirusTotal scans show 5 of 91 security vendors flagging the domain, providing additional evidence of its suspicious nature, though the exact nature of the phishing content remains unconfirmed due to limited page analysis. No specific brand impersonation has been identified in the available data, and the domain’s exact content or phishing kit is not yet analyzed. However, the combination of active status, nameserver hosting, blocklist presence, and vendor detections strongly suggests a deliberate phishing operation.

Defenders should treat this domain as high-risk and implement blocking measures at the DNS or network level. Organizations are advised to monitor for connections to efk.au and investigate any user interactions with the domain, as it may be used to harvest credentials or distribute malware. Further analysis of the page content and associated infrastructure is recommended to determine the full scope of the threat.