io-inspector[.]com

The domain io-inspector.com was registered on 21 February 2026 through InterNetX GmbH and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents the page title “IO-Inspector – Digital IO Commissioning for SIMATIC® S7®” and is served over a Google Trust Services certificate (WE1). Technical fingerprints show Cloudflare services, HTTP/3, Google Tag Manager, Google Analytics, and Cloudflare Browser Insights. The domain is classified as a brand‑impersonation campaign targeting Polygon, and three of ninety‑five VirusTotal scanners have flagged it. It is listed on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and receives a Gridinsoft trust score of 0/100, indicating a high likelihood of malicious use. The domain remains active and its risk level is marked high. While the exact phishing payload or credential‑capture mechanisms have not been publicly disclosed, the combination of a recent registration, Cloudflare hosting, and low trust scoring suggests an intentional infrastructure for fraudulent activity. Defenders should block the domain at perimeter and DNS layers, add the associated IP to reputation feeds, monitor for any related sub‑domains or similar registration patterns, and continue to observe traffic for anomalous requests that may indicate exploitation.