forexico[.]net

PhishDestroy identifies forexico.net as an active crypto drainer scam designed to trick users into connecting cryptocurrency wallets under the guise of a legitimate forex trading platform. The domain employs deception tactics commonly seen in financial scams, where victims are lured into interacting with fraudulent smart contracts that silently drain wallet funds. Technical analysis reveals that the domain resolves to IP 163.61.188.7, a hosting infrastructure previously associated with low-reputation activities. While the SSL certificate is issued by Let's Encrypt—often a misleading indicator of legitimacy—the domain’s recent creation date of November 12, 2025 (just days from now), combined with a registrar tied to TuringSign Inc. d/b/a Cosmotown, further underscores its suspicious nature. This domain exhibits multiple red flags consistent with emerging crypto scams. VirusTotal currently shows 5/95 detections—indicating that major antivirus engines have not yet flagged the domain, likely due to its recent deployment and use of obfuscated JavaScript payloads. The domain was registered through TuringSign Inc., a registrar known to facilitate bulk domain registrations with minimal verification, enabling threat actors to rapidly deploy fraudulent sites. The creation date is particularly alarming, as it suggests the scam site may be part of a coordinated campaign targeting unsuspecting traders during the holiday season. No blocklist entries have been recorded yet, likely because the domain is newly operational and has not yet been widely reported by victims. Users who accessed forexico.net or connected a wallet to the site should immediately disconnect their wallet from any dApps or websites and revoke any suspicious smart contract approvals. Transfer funds to a new wallet if funds are at risk, and consider using tools like revoke.cash to audit and revoke unauthorized token or NFT approvals. Monitor wallet activity closely and report any unauthorized transactions to local authorities or cybercrime units. Always verify URLs, use hardware wallets for sensitive transactions, and avoid interacting with unsolicited links in emails or social media.