edoctransfer[.]com

edoctransfer.com has been flagged by PhishDestroy for document theft phishing during active threat investigation. The domain mimics legitimate document transfer services to harvest sensitive files and user credentials. Interaction with this domain may result in unauthorized data extraction or account compromise, making it a high risk for organizations and individuals handling confidential documents.

This domain was flagged using seed 12fd1d after analysis by multiple threat intelligence platforms. VirusTotal shows 10/95 detections indicating no current antivirus coverage. The domain resolves to IP 52.204.246.179 and is currently blocked by the OISD blocklist. It was registered via MarkMonitor, Inc. on March 25, 2009, and has appeared on one additional security blocklist. Despite using a Let's Encrypt SSL certificate, the domain’s reputation remains compromised due to its association with active phishing campaigns targeting document uploads and sharing services.

To mitigate risk, users should avoid interacting with edoctransfer.com and report any suspicious activity. Organizations are advised to block the domain and IP at the network firewall level. If credentials or sensitive documents were shared, immediately rotate passwords and inspect connected accounts for unauthorized access. Monitor for unusual file upload patterns or data exfiltration attempts. Always validate document transfer sites via official channels before submitting sensitive information.