echo2[.]ftidev[.]link

Echo2.ftidev.link, hosted on AWS infrastructure, is flagged by 16 out of 94 vendors on VirusTotal as malicious. Despite the domain being offline now, it was first detected on April 14, 2026, the same day it was created. This rapid detection underscores the efficiency of PhishDestroy's threat-intelligence pipeline, which identifies threats in their early stages.

The domain, registered through Amazon Registrar, Inc., was associated with an IP address located in the United States. It was also flagged by Google Safe Browsing and appears on three public blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL. The SSL certificate was issued by Amazon, indicating the use of legitimate infrastructure to lend credibility to the malicious operation.

With a platform risk score of 90 out of 100, echo2.ftidev.link represents a significant threat, despite its current offline status. The high number of VirusTotal detections and its presence on multiple blocklists highlight the domain's malicious intent. This case exemplifies the ongoing challenge of combating phishing and scam domains that exploit trusted hosting services to deceive users.