etdb35y[.]com

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

The domain etdb35y.com has been identified as a credential theft phishing site, specifically designed to harvest financial login credentials through deceptive login portals. Analysis indicates the domain is currently offline, though it remains under active investigation due to its recent operational history and infrastructure patterns. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolved to the IP address 188.114.97.3 and was flagged by one security blocklist, though it received zero detections from 95 VirusTotal vendors at the time of assessment. The domain utilized a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy to fraudulent sites. The creation date suggests the domain was likely deployed for short-term malicious campaigns, a characteristic of credential theft operations seeking to evade detection. Current evidence indicates the domain has been taken offline, though residual risk persists due to the transient nature of such infrastructure. Organizations and users are advised to block the domain and its associated IP address (188.114.97.3) at the network level. Security teams should monitor for related domains registered through the same registrar (Fewmoretaps OU) or resolving to the same IP range, as these may indicate follow-on campaigns. End-users should be educated on recognizing credential theft tactics, particularly unsolicited login prompts mimicking financial institutions. Given the domain's recent creation and lack of prior detections, continuous monitoring of threat feeds for re-emergence is recommended.