web-iqoption[.]com

PhishDestroy has confirmed web-iqoption.com as an active credential theft phishing site impersonating the legitimate trading platform IQ Option. The domain is designed to harvest login credentials and potentially cryptocurrency wallet details from unsuspecting users seeking to access IQ Option services. Based on forensic analysis, this site uses social engineering tactics to mimic IQ Option’s branding, including logo, color scheme, and interface elements, to deceive visitors into entering sensitive information.

Technical analysis reveals the following indicators: the domain was registered on August 21, 2025, through MAT BAO CORPORATION and resolves to IP address 158.94.211.126. VirusTotal analysis shows 3 out of 95 security vendors have flagged the domain as malicious. The domain utilizes a Let's Encrypt SSL certificate to appear legitimate, and further investigation indicates it has not yet been blocked by Google Safe Browsing (GSB) as of this report. The low VT detection rate, combined with the recent domain registration, suggests this threat is in an early or escalating phase, posing elevated risk to potential victims.

As of this report, web-iqoption.com remains active and accessible. PhishDestroy has flagged the domain for inclusion in its threat intelligence feeds and advises immediate action to block access via DNS, firewalls, and endpoint protection platforms. Users are strongly encouraged to verify URLs carefully, avoid entering credentials on suspicious sites, and report such incidents to IQ Option and relevant cybersecurity authorities. The ongoing risk remains elevated due to the domain’s recent creation and the lack of widespread detection by security vendors.