keiko[.]finance

This domain, keiko.finance, is identified as an active crypto drainer phishing site designed to fraudulently extract cryptocurrency from victims by simulating legitimate financial transactions. Analysis indicates the domain remains operational, posing a direct threat to users engaging with decentralized finance (DeFi) platforms or cryptocurrency wallets. No specific brand impersonation has been confirmed, but the infrastructure mimics common DeFi service interfaces to deceive targets. Infrastructure analysis reveals the domain was registered on January 28, 2026, through Dynadot Inc, a registrar frequently associated with malicious domains. It currently resolves to the IP address 54.215.31.113, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. Security vendors on VirusTotal have flagged keiko.finance as malicious, with 6 of 95 engines detecting it as a phishing threat. The domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (YR2), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Additional indicators include its inclusion on PhishDestroy’s blocklist, further corroborating its malicious nature. The domain remains active as of this report, and users are advised to exercise extreme caution. Organizations should immediately block access to keiko.finance at the network level, including its resolving IP address (54.215.31.113). Cryptocurrency users should verify all transaction requests independently, avoid interacting with unsolicited links, and enable multi-factor authentication on all financial accounts. Security teams are encouraged to monitor for related domains registered through Dynadot or hosted on similar cloud infrastructure, as threat actors often reuse registrars and hosting providers for phishing campaigns.