echoray[.]click

Analysis of echoray.click, registered through NameCheap, Inc. on February 21, 2026, shows a high‑risk credential phishing operation that remains active as of the report date, July 24, 2026. The domain resolves to the IPv4 address 37.1.202.254, which is advertised as belonging to AS58061 Scalaxy B.V. in the Netherlands. Infrastructure inspection reveals the use of default registrar‑provided nameservers (dns1.registrar-servers.com and dns2.registrar-servers.com) and a 301 HTTP redirect, suggesting an attempt to funnel traffic to a concealed endpoint. The site presents a page titled "Login," aligning with the reported scam type of credential phishing, though the actual content of the page has not been publicly disclosed.

Security telemetry indicates that echoray.click appears on three independent blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing classifies the domain under social engineering, reinforcing the phishing assessment. The SSL certificate is issued by Let’s Encrypt (R12), a free certificate authority, which provides encryption but does not mitigate the malicious intent. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a lack of legitimacy.

VirusTotal analysis reports that 13 of 93 scanned security vendors flag the domain as malicious, providing additional corroboration of its threat profile. Uncertainties remain regarding the exact payload or credential collection mechanisms, as no detailed page inspection data is available. Defenders should block the domain at network perimeter, update URL filtering lists with the known blocklist entries, and monitor for outbound connections to the identified IP address. Continuous re‑scanning of the domain on multi‑vendor platforms is advised to capture any evolution in its malicious behavior.