io-en-us[.]group

The domain io-en-us.group was created on 21 February 2026 through Dynadot LLC and immediately pointed to the Cloudflare network (ASN 13335). DNS resolution returns the address 104.21.5.189, hosted in the United States under Cloudflare, Inc. The site served an HTTP 200 response and advertised the page title “China‑US Trade Relations 2026 | Global Commerce Insights”. Technical fingerprints show the use of Cloudflare Browser Insights, the standard Cloudflare reverse‑proxy, and HTTP/3 transport. The TLS certificate is issued by Google Trust Services under the “WE1” identifier, indicating a valid public‑trusted chain.

Nameserver delegation is split between kobe.ns.cloudflare.com and malavika.ns.cloudflare.com. Reputation scans reveal that the domain appears on a single security blocklist and has been flagged by four of ninety‑three VirusTotal scanners, suggesting that at least a minority of AV engines consider the site malicious. The Gridinsoft trust score is 0 / 100, the lowest possible rating, reinforcing the suspicion of abuse. PhishDestroy has already taken the site offline, and current monitoring confirms the host is no longer serving content.

While the page title references legitimate‑sounding trade topics, no additional content analysis has been published, so the exact phishing vector (credential harvest, malicious download, etc.) remains unknown. The infrastructure choices—Cloudflare front‑end, reputable Google‑signed TLS, and a widely used registrar—are typical for fast‑deployment phishing operations aiming to evade simple block‑list detection. Defenders should add 104.21.5.189 and the domain io‑en‑us.group to network‑level deny lists, enforce DNS sink‑holing for the associated nameservers, and continue to monitor VirusTotal and other reputation feeds for any resurgence.