endcoin[.]io

This report details the phishing infrastructure associated with the domain endcoin.io, classified as a generic phishing threat. The domain impersonates a Retro Text RPG to deceive visitors into potential credential harvesting or malware delivery. As of the latest assessment, the domain is offline and has been taken down.

Technical indicators for endcoin.io include a VirusTotal detection rate of 2 out of 95 security vendors flagging this domain as malicious. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to IP address 188.114.96.3. It is blocked by MetaMask, SEAL, and PhishDestroy, and appears on 3 separate security blocklists. The SSL certificate was issued by Google Trust Services, and the domain employs Cloudflare Browser Insights, Cloudflare, and HTTP/3 technologies. The Gridinsoft trust score is 0 out of 100, indicating high risk.

The domain endcoin.io is currently offline, mitigating immediate risk. However, the infrastructure may be reactivated or similar domains may appear. Recommendations include monitoring for related domains using the same registrar (Cloudflare, Inc.) or IP range (188.114.96.0/24), and adding endcoin.io to blocklists for email and web filtering. Users should be educated about fake gaming portals and verify URLs before interacting with them. Organizations should review logs for any past connections to this domain and scan for associated indicators.