erp[.]ed-intra[.]com

This domain, erp.ed-intra.com, is identified as a credential phishing threat designed to harvest user login details. The site presents a fraudulent INICIO DE SESIÓN (login) page, mimicking legitimate enterprise resource planning (ERP) portals to deceive employees or users into submitting sensitive credentials. Such attacks often lead to unauthorized account access, data breaches, or further malicious activity within corporate networks. Analysis indicates the domain was registered on February 21, 2026, through IONOS SE, a registrar commonly exploited for phishing infrastructure. It resolves to the IP address 74.208.237.139, hosted under AS8560 (IONOS SE) in the United States. Security vendors on VirusTotal flagged this domain in 17 out of 95 detection engines, confirming its malicious intent. The SSL certificate, issued by Let’s Encrypt (R13), is frequently used in phishing campaigns to lend a false sense of legitimacy. The domain appears on one security blocklist and was proactively taken offline following detection. If you or your organization visited erp.ed-intra.com and entered credentials, immediate action is required. First, reset passwords for any accounts accessed through the site, prioritizing those with administrative or financial privileges. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Monitor associated accounts for suspicious activity, such as unauthorized logins or transactions. Report the incident to your organization’s security team or IT administrator to assess potential exposure. Avoid interacting with the domain further, as it may still pose risks even if offline.