io-en-us[.]shop

The domain io-en-us.shop has been identified as a phishing infrastructure impersonating Revolut, a financial services provider. Analysis confirms this as a case of brand impersonation, designed to deceive users into disclosing sensitive credentials or financial information. The domain is currently offline, though prior activity indicates it was actively used for malicious purposes. Infrastructure analysis reveals the domain resolved to the IP address 104.21.11.77 and was registered through Dynadot LLC. Security vendors on VirusTotal flagged the domain in 4 out of 95 scans, while threat intelligence platforms such as AlienVault OTX recorded its presence in one pulse. The domain appears on three security blocklists, and third-party trust scoring systems assigned it a risk score of 0 out of 100. Detected technologies include LiteSpeed and HTTP/3, which may have been leveraged to evade detection or enhance delivery of malicious payloads. The page title, "NeuroShield | Bio-Inspired Cybersecurity & Neural Data Protection," suggests an attempt to mislead users into believing the site was related to cybersecurity rather than financial services. As of the latest verification, io-en-us.shop has been taken offline, reducing immediate risk to end users. However, organizations should maintain vigilance by ensuring the domain remains blocked at the network perimeter and in endpoint protection systems. Security teams are advised to monitor for related indicators, including the associated IP address and any newly registered domains under the same registrar or infrastructure. User awareness training should emphasize the risks of brand impersonation, particularly in financial contexts, and encourage verification of domain legitimacy before entering credentials or sensitive data.