etrdstocks[.]net

Analysis of etrdstocks.net shows a newly registered domain (creation date 21 February 2026) that resolves to the IPv4 address 176.56.39.167. The address is announced by AS21859, Zenlayer Inc., and geolocates to the United Kingdom. Hosting is provided through shared DNS services a1.share-dns.com and b1.share-dns.net, a pattern commonly observed in abuse infrastructure. The registrar listed is Gname.com Pte. Ltd., a registrar frequently used for short‑lived malicious domains.

No TLS certificate is presented, and an HTTP request returns a “404” page title, indicating the site is currently inaccessible or deliberately removed. The domain has been added to PhishDestroy’s blocklist and appears on one additional security blocklist, reflecting early detection by threat‑intelligence feeds. Gridinsoft assigns a trust score of 14 / 100, well below the benign threshold, and VirusTotal records four positive detections out of ninety‑three scanners, confirming that multiple AV engines have flagged the host as malicious. The domain is already marked offline, but its infrastructure – shared DNS, a cloud‑based IP range, and low trust rating – suggests it was intended for a generic phishing campaign.

Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP range for any resurgence, and consider adding the IP and nameservers to internal blocklists. Ongoing observation of the registrar Gname.com and the AS21859 prefix is advisable, as they have been reused in other recent phishing operations. Until further evidence emerges, the domain should be treated as a confirmed phishing indicator with elevated risk.