io-en-us[.]tech

Analysis of the domain io-en-us.tech indicates that it was provisioned on 21 February 2026 through the Dynadot LLC registrar and is currently resolved to the IP address 104.21.36.7, which belongs to Cloudflare, Inc. (AS13335) in the United States. The domain is served behind Cloudflare’s network, as evidenced by the presence of Cloudflare Browser Insights, HTTP/3 support, and the use of Cloudflare‑provided nameservers kobe.ns.cloudflare.com and malavika.ns.cloudflare.com. An SSL certificate issued by Google Trust Services under the WE1 authority secures the site, and the HTTP response returned a status code 200 at the time of observation. The page title returned by the server is “NexGen Connect | Next‑Generation Internet 2026,” suggesting an attempt to present a modern‑looking service, although the content has not been examined.

Security telemetry shows that the domain appears on a single blocklist and has been actively blocked by the PhishDestroy sinkhole. VirusTotal scans recorded four detections out of ninety‑three vendors, reinforcing the malicious classification. The Gridinsoft trust score of 0/100 further indicates a lack of legitimacy. The current operational status is offline, implying that the phishing infrastructure has been taken down or is no longer serving content.

However, the persistence of the registration, DNS configuration, and the historical detection footprint suggest that the actor may reuse the same registration details for future campaigns. Defenders should continue to monitor the domain’s DNS records for re‑activation, block the IP address 104.21.36.7 at network perimeter devices, and ensure that any inbound traffic matching the observed user‑agent strings or Cloudflare Browser Insights signatures is inspected. Inclusion of the domain and its associated IP in local blocklists, as well as sharing the indicator set with threat‑sharing communities, is recommended to prevent potential re‑use.