ekidenfi[.]com

PhishDestroy is investigating ekidenfi.com, a domain currently masquerading as a cryptocurrency exchange and posing as a generic phishing threat. The domain is active at the time of analysis and remains under active review by the PhishDestroy analyst team.

This domain was flagged by 1 of 95 VirusTotal vendors, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP 172.67.172.67. ekidenfi.com was created on May 05, 2026, and currently shows no presence on major DNS or IP blocklists. The SSL certificate protecting the site was issued by Let’s Encrypt, a common practice among both legitimate and malicious sites.

The current status of this investigation is under_investigation, indicating that further analysis is required to determine the ultimate intent of the threat actors. Users are advised to avoid interacting with ekidenfi.com, refrain from entering personal or financial information, and report any suspicious activity to their respective security teams or PhishDestroy’s public reporting portal. Organizations are encouraged to block the domain and IP at the network perimeter and update endpoint detection rules to monitor for signs of compromise. Regular threat intelligence updates will be provided as this investigation progresses.