gekoinvests[.]org

The domain gekoinvests.org was registered on October 29, 2025 via Web4Africa Inc. and is currently hosted on IP 91.235.142.237, which resolves to a Ukrainian hosting provider identified as OWL PROTECT LLC. The authoritative nameservers are ns21.v-sys.org and ns22.v-sys.org. The site presents a page titled “Gekoinvests - Investment company” and serves content over HTTPS using a Let’s Encrypt R13 certificate. HTTP responses return status 200, indicating an active web service. Automated fingerprinting reveals a typical WordPress stack with MySQL, PHP, Nginx, and front‑end libraries such as UIKit, Swiper, Smartsupp, and jQuery. The infrastructure has been flagged by six of ninety‑one VirusTotal scanners and receives a Gridinsoft trust score of zero out of one hundred, confirming a malicious classification. It is listed on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. The threat is categorized as a generic phishing campaign delivering an investment‑scam payload. While the page title suggests an investment‑company façade, no additional content analysis is available, leaving the exact lures and credential‑collection mechanisms uncertain. Defenders should block DNS resolution to the domain, add the IP address to deny lists, and monitor outbound traffic for connections to the listed nameservers. Continuous scanning of the host for new payloads and periodic re‑evaluation of VirusTotal and blocklist status are recommended to mitigate potential compromise.