forge-eth[.]co

Analysis of forge-eth.co as of July 25, 2026 indicates that the domain is associated with a crypto‑related phishing campaign. The site title reported by scanners is “FORGE ETH”, suggesting an attempt to lure victims interested in Ethereum. VirusTotal records show that six of ninety‑four scanners flagged the domain, providing independent confirmation of malicious intent. The domain resolves to the IPv4 address 37.1.204.81, which is registered to AS58061 Scalaxy B.V. in the Netherlands. Hosting details reveal an Ubuntu operating system running Node.js behind an Nginx web server, with the Express framework and Cloudflare as a reverse‑proxy; HTTP responses include HSTS headers, indicating enforcement of TLS. The SSL certificate is identified as “R12”, confirming that transport encryption is in place.

Registrant information lists Iroko as the registrar, and the authoritative name servers are ns73.domaincontrol.com and ns74.domaincontrol.com, both typical of GoDaddy’s DNS service. Multiple defensive feeds have already taken action against the domain. PhishDestroy, MetaMask, and SEAL have added it to their blocklists, and it appears on three additional security blocklists. The site is currently reported as offline, which may be a temporary takedown or a deliberate shutdown after initial distribution. No further content has been captured beyond the page title, so the exact phishing payload or credential‑stealing forms remain unknown.

Defenders should continue to block traffic to 37.1.204.81 and monitor for any re‑hosting of the same infrastructure, especially services that reuse the same Node.js/Express stack or the same Cloudflare configuration. Threat intel platforms should update indicators of compromise to include the domain name, the resolved IP, the registrar (Iroko), and the observed name servers.