forexra[.]cc

Analysis of the domain forexra.cc, observed on July 22, 2026, indicates that it is associated with an investment‑type phishing campaign. The domain resolves to the IP address 172.67.162.34, which is owned by Cloudflare, Inc. (AS13335) and located in the United States. Registration records show that forexra.cc was created on March 04, 2025 through Domain International Services Limited, and it is served by a single authoritative nameserver.

No SSL certificate was detected for the domain, implying that any web service would have operated over plain HTTP. VirusTotal scans report that four of ninety‑five security vendors flagged the domain, evidencing malicious activity, and the domain appears on one external blocklist, specifically PhishDestroy. The site is currently listed as offline, and no active HTTP response could be captured at the time of reporting.

The available intelligence classifies the threat as a generic phishing operation targeting investment victims, but the actual page content, page title, or targeted brand have not been publicly disclosed, leaving those aspects uncertain. Defenders should add the IP 172.67.162.34 to network‑based blocklists, enforce URL filtering for forexra.cc, and monitor for any resurgence of the domain or related Cloudflare‑hosted assets. Continuous correlation with threat‑intel feeds for similar Cloudflare‑hosted phishing infrastructure is recommended, as well as periodic re‑scanning of the domain should it become active again.