io-inv[.]com

io-inv.com is currently flagged as a fake cryptocurrency trading and investment platform. The site was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare, resolving to IP 188.114.96.3 located in the United States under ASN 13335 (Cloudflare, Inc.). The TLS certificate presented is issued by Google Trust Services under the WE1 label, indicating a valid‑looking HTTPS endpoint. HTTP requests return a 403 status code, and the page title observed is “IO INV | Cryptocurrency trading and invest platform”, suggesting an attempt to lure victims interested in crypto assets. VirusTotal analysis shows that six of ninety‑three scanners have raised alerts, and the domain appears on one external security blocklist.

PhishDestroy has explicitly blocked the domain, and Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. Detected web technologies include jQuery, Cloudflare, and HTTP/3, which are common in phishing kits but provide no additional attribution. The nameservers aragorn.ns.cloudflare.com and serena.ns.cloudflare.com are standard Cloudflare entries. The current operational status is offline, which may be a temporary takedown or an evasion technique.

Because the site’s content has not been captured, the exact phishing flow, credential harvesting mechanisms, and any third‑party resources remain unknown. Defenders should continue to monitor the domain and associated IP address for re‑activation, add the domain to internal blocklists, and enforce DNS filtering that denies resolutions to 188.114.96.3. Threat‑intel platforms should note the registration details, SSL issuer, and the modest VirusTotal detection count for correlation with future campaigns that reuse the same infrastructure or branding language. Organizations dealing with cryptocurrency customers should advise users to verify URLs against official sources and to avoid unsolicited investment links.