iqinvestbroker[.]com

On July 26, 2026, the domain iqinvestbroker.com was observed hosting a generic phishing site. The domain remains active and resolves to a web server that returns HTTP 200 for the root URL. Analysis of the hosting records shows it is served by the nameservers dns1.webproserver.com and dns2.webproserver.com, both under the control of the registrar OwnRegistrar, Inc. The same registrar is listed as the registration authority. The domain has been added to the blocklist maintained by PhishDestroy and also appears on an additional public blocklist, indicating that at least one threat‑sharing platform has flagged it.

VirusTotal scans have returned positive detections from 12 of 91 security vendors, reinforcing the suspicion of malicious intent. No further technical details such as SSL certificate metadata, IP address, ASN, or geolocation are available in the current intelligence set. The lack of additional context, such as the exact page title or the targeted brand, limits attribution of the phishing campaign to a specific actor or template.

Defenders should block any outbound or inbound traffic to iqinvestbroker.com at the network perimeter, add the domain to local DNS blacklists, and monitor for credential‑stealing attempts that reference the domain. Security teams should also correlate any user‑reported suspicious emails that reference “iqinvestbroker” with this indicator, and consider updating email filtering rules to quarantine messages that contain URLs pointing to the domain. Continuous re‑evaluation is advised, as further analysis may reveal additional infrastructure components or victim targeting patterns.