io-connection[.]sbs

The domain io-connection.sbs was registered on December 19, 2025 through NiceNIC International Group Co., Limited. It resolves to 172.67.171.124, which belongs to AS13335 Cloudflare, Inc., located in the United States. The authoritative nameservers are sureena.ns.cloudflare.com and west.ns.cloudflare.com, indicating that the domain is fully proxied behind Cloudflare’s edge network and is served over HTTP/3. An SSL certificate issued by Google Trust Services (WE1) is present, providing a valid TLS handshake but offering no indication of legitimacy.

The site returns an HTTP 302 redirect on initial request, a pattern frequently employed by phishing infrastructure to forward victims to a malicious landing page after a brief delay. VirusTotal reports that seven of ninety‑three scanners flag the domain, demonstrating that a minority of security products have identified it as malicious. The domain appears on a single public blocklist and is actively blocked by PhishDestroy, confirming that at least one industry‑focused anti‑phishing service has catalogued it as a threat. The page title returned by the server is the plain string “io-connection.sbs”, offering no additional context about the intended target or campaign.

No further content analysis is available, so the specific phishing lure remains unknown. Defenders should add the domain and its IP address to outbound filtering rules, block DNS resolution, and monitor for any HTTP 302 redirects to this host in network traffic. Because the site is hosted behind Cloudflare, traditional IP‑based blocking may be less effective; employing domain‑level controls such as proxy or DNS sinkhole is recommended. Continuous re‑scanning of the domain on VirusTotal and other sandbox services is advised to capture any evolving payloads or changes in detection status.