forexeko[.]com

forexeko.com is a recently activated generic crypto-drainer phishing domain first observed on May 29, 2024. The site mimics a forex trading portal to trick users into connecting cryptocurrency wallets and authorizing malicious token-transfer scripts. No specific brand is mimicked in the lure, and no known drainer kit family has yet been fingerprinted. Investigations are ongoing to extract the JavaScript payload and map the campaign infrastructure. This domain resolves to IP address 92.205.133.17 and is served over an SSL certificate issued by GoDaddy.com, Inc. VirusTotal currently shows 0 detections out of 95 engines, and the domain is not yet flagged in Google Safe Browsing. The registrar is GoDaddy.com, LLC, and the domain was created on May 29, 2024, making it a very young registration with a short-lived reputation profile. forexeko.com remains active and continues to serve the fake forex portal. No takedown or blocklisting actions have been recorded at this time. Given the absence of third-party detections and the domain’s brief operational window, the residual risk is assessed as high until automated scanners catch up and blocklisting services respond. Users should avoid visiting the site and report it through their browser’s phishing alert channels.