s[.]edoctransfer[.]com

This domain, s.edoctransfer.com, is identified as a fake login portal designed to harvest credentials through deceptive web forms. Analysis indicates the site impersonates legitimate document transfer services, likely targeting corporate or financial sector users under the guise of secure file sharing. The phishing page employs social engineering tactics, such as urgent requests for login verification, to trick victims into submitting sensitive information like usernames, passwords, and multi-factor authentication codes. Infrastructure analysis reveals the domain was registered on March 25, 2009, through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. It resolves to the IP address 52.204.246.179 and currently appears on two security blocklists: PhishDestroy and OISD. The domain’s SSL certificate is issued by Let’s Encrypt, a common tactic to lend false legitimacy to phishing sites. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious, with detections spanning phishing, fraud, and credential theft categories. Notably, the page title, '404 - Quick Tip | Cofense,' suggests an attempt to mimic or exploit branding associated with security awareness training, potentially to evade suspicion. Users who visited s.edoctransfer.com should assume their credentials may have been compromised. Immediate actions include resetting passwords for any accounts accessed or entered on the site, enabling multi-factor authentication where available, and monitoring accounts for unauthorized activity. System administrators should block the domain and its associated IP (52.204.246.179) at the network level to prevent further access. If sensitive data was submitted, affected parties should report the incident to their organization’s security team or relevant data protection authorities for further mitigation.