io-mon[.]site

This domain, io-mon.site, operates as a credential theft portal designed to harvest user login details under the guise of an educational institution. The site displays a page title in Cyrillic—Проект Институт по Образование – Институт по Образование—suggesting it targets users associated with academic or research organizations. Analysis indicates the domain is engineered to mimic legitimate educational platforms, tricking visitors into entering sensitive credentials, which are then captured for malicious use. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on June 02, 2026, through GoDaddy.com, LLC, an unusually future-dated creation that may indicate fraudulent registration practices. It resolves to the IP address 94.23.153.90 and is flagged by 4 out of 95 security vendors on VirusTotal, including detections from reputable threat intelligence feeds. Additionally, the domain appears in two AlienVault OTX pulses and is listed on three security blocklists, further corroborating its malicious intent. The SSL certificate, issued by Let's Encrypt, provides basic encryption but does not validate the legitimacy of the site’s operations. Users who visited io-mon.site should take immediate remedial actions. First, revoke any credentials entered on the site, particularly those linked to institutional or email accounts. Monitor associated accounts for unauthorized access or suspicious activity, including password reset attempts or unusual login locations. If financial or personal data was submitted, consider placing fraud alerts with relevant institutions. Finally, report the domain to local cybersecurity authorities or incident response teams to aid in broader threat mitigation efforts.