echo[.]markroah[.]com

echo.markroah.com is a subdomain of markroah.com. PhishDestroy first observed the hostname on Jun 14, 2026. The captured page title is “Echo”. Stored page analysis classifies the content as fake airdrop. Campaign clustering links the hostname to the Airdrop Scam kit. Current evidence score: 93/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, MetaMask, and SEAL. VirusTotal recorded 3 detections among 91 engines: CRDF, Gridinsoft, SOCRadar on Jul 26, 2026 at 02:26 UTC. MetaMask and SEAL listed the hostname in the separate external-blocklist snapshot on Aug 8, 2026 at 06:20 UTC. Non-positive and contextual checks: Google Safe Browsing returned no flag on Apr 25, 2026 at 05:00 UTC.

Cloaking was recorded with HTTP 308 on Aug 7, 2026 at 22:14 UTC. The cloaking probe recorded content split conditional delivery at 1/100 on Aug 7, 2026 at 22:11 UTC: redirect: raw=redirect_308; http=308; via=https_proxy; location=https://echotap.io/; server=Vercel. Registration records for the registrable domain markroah.com list Name.com, Inc. as the registrar and Apr 24, 2026 as the creation date. At collection time, the hostname resolved to 76.76.21.142 on AS16509 (Amazon.com, Inc.). The IP and ASN identify shared Vercel edge infrastructure; the origin server is not established by this address. TLS metadata lists Let's Encrypt / R12 as the certificate issuer with validity through Jul 23, 2026; checked Apr 24, 2026 at 20:00 UTC.

The content indicators and 3 positive source findings support the current fake airdrop classification.