eko24[.]cc

Analysis of the domain eko24.cc indicates active generic phishing infrastructure with high-risk characteristics. The domain was registered on March 11, 2026, and remains operational as of July 12, 2026. It resolves to the IP address 188.114.96.3, associated with AS13335, a network commonly used for both legitimate and malicious traffic. The domain is hosted behind Cloudflare nameservers dane.ns.cloudflare.com and paige.ns.cloudflare.com, a configuration frequently observed in phishing campaigns to obscure origin servers and evade detection. The domain appears on one security blocklist and has been included in two threat intelligence pulses in AlienVault OTX, suggesting prior identification as malicious. A Gridinsoft trust score of 0 out of 100 further supports the assessment of high risk. While VirusTotal reports only one security vendor flagging the domain out of 95, this limited detection does not diminish the validity of other indicators. The HTTP response code is 200, but the page title consistently returns a 522 connection timeout, which may indicate backend instability or intentional misdirection to avoid automated analysis. Infrastructure analysis reveals the domain uses an SSL certificate issued by Google Trust Services, specifically the WE1 intermediate. While the presence of SSL does not inherently indicate malicious intent, it is commonly exploited in phishing to lend false legitimacy. The registrar, NiceNIC International Group Co., Limited, has been associated with other domains involved in fraudulent activity, though no direct attribution to threat actors is confirmed. Defenders should treat this domain as active phishing infrastructure and implement blocking at the DNS or network level. Monitoring for related domains registered through the same registrar or resolving to the same IP may uncover additional threats.