io-en-us[.]site

The domain io-en-us.site was first registered on 04 January 2026 through NameSilo, LLC. DNS resolution points to the Cloudflare edge address 104.21.26.187, which belongs to AS13335 Cloudflare, Inc., and the authoritative nameservers are rosa.ns.cloudflare.com and tom.ns.cloudflare.com. The site does not present an SSL/TLS certificate, indicating that HTTPS was not configured at the time of capture. The HTTP response returned a title tag reading “MythosShield | Mythological Cybersecurity & Archetypal Defense Systems”, which does not reference the targeted brand but is indicative of a fabricated security‑related landing page. The campaign is classified as brand impersonation targeting the “scroll” brand, as indicated in the supplied intelligence.

Reputation checks show that the domain appears on a single security blocklist and has been flagged by the PhishDestroy sinkhole. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. AlienVault’s Open Threat Exchange recorded the domain in one threat‑intel pulse, and VirusTotal analysis recorded six positive detections out of ninety‑three scanning engines. The combination of low trust scoring, blocklist presence, and multiple vendor detections supports the assessment of elevated risk.

The current operational status is offline, suggesting that the phishing infrastructure has been taken down or is no longer serving content. However, the underlying hosting on Cloudflare and the registrar details remain active, allowing the possibility of rapid re‑deployment. Defensive teams should continue to block the domain at perimeter filters, monitor the associated IP address for any resurgence, and consider adding the domain to internal threat‑intel feeds.