ecorntrading[.]com

This domain is flagged as an active credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates an elevated risk level due to its recent deployment and confirmed malicious infrastructure, designed to capture sensitive authentication details under false pretenses. Infrastructure analysis reveals the domain ecorntrading.com was registered on February 03, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 2.58.56.152, hosted on AS210558 (1337 Services GmbH) in the Netherlands. The SSL certificate is issued by GoDaddy.com, Inc. under the Go Daddy Secure Certificate Authority - G2. Detection metrics show 17 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The page title 'Just a moment while we check...' suggests the use of evasive techniques to delay or mislead automated analysis tools. Mitigation against this credential harvesting threat requires immediate action. Network administrators should implement DNS-based blocking for the domain and its associated IP address 2.58.56.152. End users should be advised to avoid interacting with any login prompts or forms presented by this domain. Security teams are recommended to monitor for indicators of compromise, including unexpected authentication attempts or anomalous outbound connections to the identified infrastructure. Organizations should also review and update their phishing awareness training to include recent tactics observed in this campaign, particularly those involving delayed redirects and false security checks.