io-cn-28[.]com

io-cn-28.com was registered on 2026-01-11 through NameMart Pte. Ltd. The domain resolves to 156.232.139.14, an address assigned to AS134548 DXTL Tseung Kwan O Service in Hong Kong. Passive DNS and WHOIS data indicate the site is currently offline, and the same IP appears on a single security blocklist. The SSL certificate is labeled “R12”, and Gridinsoft assigned a trust score of 0 out of 100, suggesting a lack of reputable security posture. The HTTP response that was captured before takedown returned a page title in Chinese, “加拿大28首页 - 官方平台 - 走势更新”, which does not correspond to any known legitimate service and is typical of fraudulent landing pages used in phishing campaigns.

VirusTotal analysis recorded detections from two of ninety‑three AV engines, confirming that at least a subset of scanners consider the domain malicious. The feed PhishDestroy also listed the domain as blocked. The overall risk rating is elevated, reflecting the combination of low trust score, certificate anomalies, and positive detections. What remains unknown includes the specific phishing kit, targeted brands, and the exact content served before the site was taken offline; no sandbox or content capture has been published.

Defenders should continue to block the domain at perimeter and DNS layers, monitor the hosting IP for any re‑use, and add the associated ASN to watchlists. Periodic re‑resolution checks are advised in case the infrastructure is resurrected, and any inbound traffic should be logged for potential credential harvesting attempts. Incident response teams should treat any credential submissions associated with this domain as compromised and enforce password resets for affected users.