www1[.]inputecho[.]co

The domain www1.inputecho.co was registered on March 10, 2026 through Porkbun LLC. It is currently active and classified as a high‑risk generic phishing site. The public page presents a title “Get the Funding YouNeed – Fast”, which is typical of fraudulent financing offers used to harvest credentials.

Infrastructure analysis shows the domain resolves to the IP address 44.230.85.241, which is hosted in the United States under ASN 16509 belonging to Amazon.com, Inc. The authoritative nameservers are curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador.ns.porkbun.com. The site presents a valid Let’s Encrypt certificate (R12) and returns an HTTP 301 redirect before delivering the content. Technical fingerprinting identifies a WordPress core with MySQL, PHP, Yoast SEO, Swiper, jQuery, and jQuery Migrate, indicating a standard content‑management platform deployed on Amazon Web Services.

Threat intelligence assigns a Gridinsoft trust score of 0 out of 100, reflecting extreme maliciousness. VirusTotal reports a single positive detection out of 95 scanned security vendors, and the domain appears on three public blocklists: PhishDestroy, MetaMask, and SEAL. These indicators, combined with the high‑risk rating and the phishing classification, confirm that the site is being used to lure victims into providing personal or financial information.

Defenders should immediately block www1.inputecho.co at perimeter firewalls, DNS resolvers, and proxy filters. Continuous monitoring of the associated IP 44.230.85.241 is advised to detect any pivoting activity. Security teams should update phishing detection signatures to include the observed page title and WordPress fingerprint. End‑user awareness campaigns should warn users about unsolicited funding offers that redirect to this domain.