erc56[.]com

The domain erc56.com is currently listed on one public security blocklist and is actively blocked by the PhishDestroy filtering service. Its HTTP response code of 301 indicates that requests are being permanently redirected, a pattern often leveraged by malicious operators to hide the final landing page or to funnel traffic through intermediate hosts. Registration data shows the domain was created through Gname.com Pte. Ltd., a registrar that does not provide additional reputation signals.

The authoritative name servers are adam.ns.cloudflare.com and chan.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare's DNS and potentially its edge network, which can obscure the originating IP address and complicate attribution. VirusTotal analysis reports that three out of ninety‑one scanned security vendors have flagged the domain, reinforcing the suspicion that it is being used for malicious purposes. The domain’s risk level is rated high, and its status is marked as active, meaning the infrastructure is still operational.

While the available data confirms the presence of a blocklist entry, a redirect response, Cloudflare name servers, and multiple vendor detections, the exact payload or credential‑stealing page has not been publicly disclosed, leaving the specific phishing content uncertain. Defenders should continue to block erc56.com at perimeter firewalls and DNS filtering solutions, monitor for any outbound connections to its resolved IP addresses, and consider adding it to internal blocklists. Continuous re‑scanning on multi‑vendor platforms such as VirusTotal is advisable to capture any new detections, and threat‑intel teams should track any changes to its DNS records that might indicate a shift in hosting or a new campaign launch.