ecg[.]soundestlink[.]com

This domain, ecg.soundestlink.com, is currently flagged as an active high-risk phishing endpoint targeting users of the Omnisend marketing platform. Analysis indicates the domain has been listed on three security blocklists, including PhishingDB, OISD, and BLP-Malware, confirming its classification as malicious infrastructure. The page title explicitly displays 'Omnisend,' suggesting the phishing campaign is designed to harvest credentials or sensitive information associated with that service. While the exact content of the site remains unanalyzed, the presence of this title aligns with known phishing tactics used to deceive users into believing they are interacting with a legitimate platform. Infrastructure analysis reveals the domain resolves to the IP address 172.64.145.78 and is protected by Cloudflare, a common obfuscation technique used to conceal the true origin of malicious activity. The domain was registered through Cloudflare, Inc. in November 2014, though its long registration history does not mitigate its current malicious use. Detected technologies include Envoy, HSTS, and HTTP/3, which are consistent with modern web infrastructure but do not inherently indicate legitimacy. The SSL certificate is issued by Google Trust Services, providing encrypted connections that may further deceive users into trusting the site. Of the 95 security vendors on VirusTotal, only two currently flag this domain, indicating limited detection coverage and potential for evasion. The Gridinsoft trust score of 0/100 reinforces the domain's high-risk status. Defenders should treat this domain as actively malicious and prioritize blocking it at the DNS or network level. Organizations using Omnisend or similar marketing platforms should alert users to this threat and monitor for unauthorized access attempts originating from interactions with this domain. Given the domain's continued activity as of July 12, 2026, ongoing vigilance and proactive mitigation are recommended.