erdehuui[.]com

On 21 February 2026 the domain erdehuui.com was registered through NiceNIC International Group Co., Limited. The domain resolves to the IPv4 address 89.34.219.167, which belongs to AS215439 PLAY2GO INTERNATIONAL LIMITED and is geolocated to Germany. Cloudflare nameservers (margo.ns.cloudflare.com, rosemary.ns.cloudflare.com) are configured for the domain. No TLS certificate is presented, indicating that HTTPS connections are not supported. The only visible page title retrieved during analysis reads “Home page | eflow”, suggesting the site may be attempting to masquerade as an eflow service, although the exact impersonated brand cannot be confirmed without further content inspection.

The domain was listed on a single security blocklist and has been flagged by PhishDestroy as malicious. VirusTotal scans show that eight of ninety‑three scanning engines reported the domain as malicious, providing additional corroboration of its threat nature. The domain’s current HTTP status is offline, and the infrastructure appears to have been taken down at the time of this report. Risk is assessed as elevated.

Defenders should continue to block the domain at perimeter filters, update URL reputation feeds, and monitor the associated IP address for any re‑activation. Because the site lacks TLS, any future re‑hosting would be observable via clear‑text HTTP requests. Analysts should also track the registrar NiceNIC International Group for any patterns of abuse and consider reporting the domain to additional blocklist operators to broaden defensive coverage. At present, the limited available evidence prevents a detailed attribution of the phishing kit or specific victim vector, and further investigation would be required to determine the exact payload or credential‑harvesting mechanisms employed.