ekkotech[.]nl

This domain, ekkotech.nl, is currently flagged as an active credential phishing site with a high risk level. Registered on October 8, 2025, through GoDaddy.com, LLC, the domain resolves to IP address 199.36.158.100, hosted on AS54113 (Fastly, Inc.) in the United States. The nameservers ns01.domaincontrol.com and ns02.domaincontrol.com are associated with the registrar's infrastructure, a common pattern in phishing operations leveraging bulk domain registration services. Analysis indicates limited but actionable detection coverage: three of ninety-five security vendors on a multi-engine scanning platform have flagged the domain, and it appears on two security blocklists, including PhishDestroy and ScamSniffer. The domain returns an HTTP 200 status, confirming active hosting, and presents a page titled 'Home | EkkoTech,' though the exact content and intended target remain unconfirmed due to lack of deeper forensic analysis. The site employs Firebase and reCAPTCHA, technologies frequently used in both legitimate and malicious contexts to enhance interactivity and evade automated detection. The presence of HSTS and HTTP/3 suggests an attempt to project legitimacy through modern security and performance standards. Defenders should treat this domain as hostile based on current blocklist inclusion and vendor detections. The SSL certificate, issued by Google Trust Services, provides transport security but does not validate the site's legitimacy. Given the domain's recent creation and association with a known content delivery network, monitoring for additional domains resolving to the same IP or utilizing identical nameserver configurations is recommended. Immediate blocking at the network and endpoint levels is advised, with continued observation for shifts in infrastructure or detection patterns.