aedcofragrances[.]com

PhishDestroy identifies aedcofragrances.com as an active phishing domain operating at elevated risk, luring users under the guise of a fragrance retailer to harvest login credentials and payment details.

This domain was flagged by 13 of 95 VirusTotal security vendors, indicating early-stage malicious recognition. It resolves to IP address 192.185.73.152 and uses a Let’s Encrypt SSL certificate to appear legitimate. Registered through GoDaddy.com, LLC on October 21, 2020, the domain has been active for over three years, allowing threat actors time to establish infrastructure and refine social-engineering tactics. Despite its age, it has not achieved broad trust, as evidenced by its limited detection coverage and lack of widespread inclusion on major blocklists at this time.

Mitigation begins with immediate network and endpoint blocking of both the domain and its resolving IP address. Users who may have accessed the site should be instructed to change any reused passwords and monitor financial accounts for unauthorized transactions. Security teams should inspect DNS and proxy logs for historical connections to the domain and consider deploying browser-based warnings using threat intelligence feeds. Given the domain’s reliance on a recently issued SSL certificate and the absence of strong brand protection signals, organizations should prioritize user awareness training focused on verifying domain authenticity and avoiding unsolicited links purporting to offer fragrance promotions or discounts.