echocoin[.]kivyetu[.]com

The domain echocoin.kivyetu.com is currently active and has been identified as a generic phishing site. The public page presents the title “Amara Africa”, which does not correspond to any known legitimate service associated with the domain name. The site returned HTTP 200 and serves a valid Let's Encrypt certificate (YE1). Analysis of public threat feeds shows nine out of ninety‑five VirusTotal scanners have flagged the host as malicious. The domain was registered on 12 March 2026 through OwnRegistrar, Inc. DNS resolution points to the IPv4 address 5.189.185.96, which is hosted by Contabo GmbH in France. The authoritative nameservers are ns1.contabo.net, ns2.contabo.net, and ns3.contabo.net, confirming the use of Contabo’s infrastructure. No additional IP aliases or CDN layers were observed, indicating a direct hosting relationship. Multiple security platforms have taken action against the domain. It appears on three independent blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 / 100, reflecting extreme distrust. The combination of nine VirusTotal detections, blocklist listings, and a zero trust score provides strong evidence of malicious intent. Open questions remain regarding the exact phishing campaign details, such as the credential collection page structure and any associated malware payloads, because the site content has not been fully archived. Defenders should continue to block the domain at perimeter firewalls, update DNS filtering policies to include the listed nameservers, and monitor for any new sub‑domains under the same registrar. Incident response teams should also capture network traffic from any user interaction with the site for forensic analysis.