igobit[.]com

The domain igobit.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently taken offline. Technical reconnaissance shows the domain resolves to IP address 104.21.42.225, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are dawn.ns.cloudflare.com and gabe.ns.cloudflare.com, confirming the use of Cloudflare’s DNS and networking services. An SSL certificate issued by Google Trust Services under the WE1 label secures the site, indicating that HTTPS was enabled before the domain was retired. The HTTP response returned a 403 status code, suggesting that requests were being blocked or access was denied at the web server level. Cloudflare is the only technology detected, consistent with the hosting infrastructure.

Reputation signals are strongly negative. The page title extracted from the site reads "IGOBIT: Crypto Asset Exchange," yet the domain is flagged for brand impersonation of the cryptocurrency platform ton. Google Safe Browsing classifies the URL as social engineering, and three independent blocklists – PhishDestroy, MetaMask, and SEAL – have added the domain. VirusTotal reports that 13 of 95 scanned security vendors flagged the domain, reinforcing its malicious reputation. AlienVault OTX references the domain in a single threat‑intelligence pulse, and the Gridinsoft trust score is 0 out of 100, indicating a lack of trust. Overall, the domain appears on three public blocklists.

While the exact malicious payload or phishing kit has not been publicly disclosed, the convergence of a brand‑targeted page title, multiple blocklist listings, low trust scoring, and a high detection rate on VirusTotal suggests a coordinated attempt to harvest credentials or assets related to the ton platform. Defenders should continue to block traffic to 104.21.42.225 and associated hostnames, update URL filtering policies to include igobit.