decoteq[.]co[.]za

The domain decoteq.co.za was identified as a phishing site engaged in brand impersonation targeting Facebook users. It posed as the legitimate Facebook platform to deceive victims into disclosing login credentials, classified as a social media scam. No crypto drainer kit was associated with this campaign. The site is currently taken offline, reducing immediate risk but not eliminating potential follow-on fraud.

Technical analysis shows decoteq.co.za was flagged by 3 of 95 VirusTotal security vendors, including ChainPatrol, Seclookup, and SOCRadar. It appeared on one security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. The domain was registered through xneelo (Pty) Ltd on July 15, 2019, and resolved to IP address 129.232.138.43, hosted in South Africa under AS37153. The SSL certificate was issued by Let's Encrypt (R13), and the observed page title was 'Home - Decoteq'. Technologies detected included WordPress, MySQL, PHP, and Apache HTTP Server. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification.

Victims of decoteq.co.za should immediately change their Facebook passwords and enable two-factor authentication to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized posts or messages sent to contacts. Report the phishing domain to Facebook via their official reporting channels and to local cybersecurity authorities or organizations like the Anti-Phishing Working Group (APWG). If financial or personal data was exposed, consider placing a fraud alert on credit files.