io-tradebridge[.]xyz

This domain, io-tradebridge.xyz, is identified as a high-risk cryptocurrency phishing site targeting users through fraudulent wallet interfaces. Analysis indicates the domain is designed to harvest login credentials and private keys under the guise of legitimate cryptocurrency services. As of the latest assessment, the domain is classified under the threat type 'generic_phishing' with no specific brand impersonation confirmed, though the infrastructure aligns with common cryptocurrency-themed attacks. Infrastructure analysis reveals the domain was registered on May 31, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. It resolves to the IP address 104.21.71.172, which is part of a network known for hosting phishing and scam content. The domain appears on three security blocklists and has been flagged by 14 out of 95 vendors on VirusTotal, including detection by cryptocurrency-specific security tools. Technologies detected include Cloudflare and HTTP/3, which are often leveraged to obfuscate malicious activity and evade detection. The page title 'Success!' is a common indicator of phishing pages designed to mimic successful transaction or login confirmations. The domain has been taken offline, reducing immediate risk to users. However, similar infrastructure may reappear under different domains. Organizations and individuals are advised to block the domain and its resolving IP at the network level. Cryptocurrency users should verify wallet addresses and transaction details through official channels only. Security teams are recommended to monitor for domains registered through the same registrar or resolving to the same IP range, as these may indicate related malicious activity. Proactive measures, such as implementing DNS filtering and endpoint protection rules, are critical to mitigating future threats from this actor.