# keorax.net — SUSPICIOUS

> keorax.net hosts a credential harvesting scam targeting users. Domain registered in 2026. Check the full report for details and risk mitigation.

## Summary
keorax.net is currently identified as a credential harvesting scam site. This domain attempts to deceive victims into providing sensitive login information, though no specific brand has been impersonated, nor any known drainer kit has been linked to it at this moment. The campaign is actively under investigation to determine the full scope of its operations and potential targets.

Technical indicators reveal that keorax.net was registered recently on March 23, 2026, through Fewmoretaps OU doing business as Trustname.com. The domain resolves to the IP address 172.67.140.215 and uses a free SSL certificate issued by Let's Encrypt. VirusTotal analysis shows 0 detections out of 95 antivirus engines, indicating the site has not yet been flagged by major security vendors. Additionally, there is no known Google Safe Browsing block or relevant entries on mainstream blocklists reported so far.

The status of keorax.net remains active and its risk profile is under ongoing review. Given the clean VT score but active reports of credential harvesting, users should exercise caution and avoid entering any personal data on this domain. Security teams are advised to monitor for changes in domain behavior, update blocklists accordingly, and inform end users about this emerging threat. Immediate containment is recommended to prevent potential credential theft and subsequent fraud.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-23 08:39:26
- Registrar: Fewmoretaps OU d/b/a Trustname.com
- IP: 172.67.140.215

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/keorax.net
- PhishDestroy: https://phishdestroy.io/domain/keorax.net/
- LLM endpoint: https://phishdestroy.io/domain/keorax.net/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/keorax.net/
Last updated: 2026-04-04