io-uk[.]xyz

Analysis conducted on 24 July 2026 identifies the domain io-uk.xyz as an elevated‑risk generic phishing infrastructure that has been taken offline. The domain was registered on 20 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is associated with a Cloudflare‑provided IP address 188.114.97.3, located in the United States and advertised under ASN 13335 (Cloudflare, Inc.). DNS resolution uses the Cloudflare nameservers david.ns.cloudflare.com and elinore.ns.cloudflare.com, indicating that the attacker leveraged Cloudflare’s CDN and DNS services to mask the true origin of the host. A Let’s Encrypt certificate (issuer “YE1”) was observed, which is typical for short‑lived malicious sites and does not provide any authentication of the underlying content.

Reputation data shows a Gridinsoft trust score of 0 / 100, confirming a lack of legitimacy. The domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple threat‑intelligence feeds have flagged it. VirusTotal scans recorded two positive detections out of 91 scanners, further corroborating malicious behavior. No additional public metadata such as page title or Safe Browsing classification is currently available, leaving the exact phishing payload or targeted brand unknown.

Defenders should continue to block the domain at network perimeter and DNS filtering layers, add the associated IP address to deny‑list rules, and monitor for any resurgence of the domain or related sub‑domains. Given the use of Cloudflare’s infrastructure, future re‑hosting of the same payload under different hostnames is plausible; therefore, threat‑intel teams should correlate any new domains resolving to 188.114.97.3 or sharing the same registrar with this indicator set. Continuous re‑evaluation of blocklist entries and periodic VirusTotal rescans are recommended to capture any changes in the threat landscape.