1ido[.]org

PhishDestroy identifies the domain 1ido.org as an active threat engaged in generic phishing, targeting users with no specific brand impersonation detected. This domain does not currently appear to leverage a known drainer kit but functions as a credential harvesting platform, attempting to deceive victims with a generic phishing page titled "www.www.1ido.org".

The domain 1ido.org yields a VirusTotal detection ratio of 1 out of 95 security vendors, indicating low but non-negligible recognition as malicious. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 172.67.154.139 and is secured by an SSL certificate issued by Google Trust Services. This domain was created recently on November 09, 2025, and despite its fresh registration, it lacks a Google Safe Browsing block (GSB status not flagged) and has a limited blocklist presence, which suggests it may evade some automated defenses.

Currently, 1ido.org remains active with an elevated risk level due to its ongoing phishing activity targeting generic credentials. Security teams are advised to monitor and block this domain proactively given its potential for user credential compromise despite a low VirusTotal detection count. Users should avoid interacting with this domain and report any suspicious communications linked to it. Continued vigilance and updates to endpoint protections will help mitigate exposure as threat intelligence evolves.