igobit[.]io

Analysis of the domain igobit.io indicates active phishing infrastructure targeting cryptocurrency users. The domain, registered on February 21, 2026, through NiceNIC International Group Co., Limited, currently resolves to IP 188.114.97.3, hosted on Cloudflare's AS13335 network in the United States. The page title, 'IGOBIT: Crypto Asset Exchange,' suggests an attempt to impersonate a legitimate cryptocurrency exchange platform, though the exact content and functionality of the site remain unconfirmed due to lack of direct analysis. Security vendors have flagged this domain with 12 detections out of 91 on VirusTotal, while Google Safe Browsing classifies it as social engineering.

The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites commonly use valid certificates. A 301 HTTP redirect is present, which may indicate an attempt to funnel victims to a secondary malicious endpoint. Infrastructure analysis reveals Cloudflare nameservers (sydney.ns.cloudflare.com and west.ns.cloudflare.com) and HTTP/3 support, consistent with modern phishing campaigns leveraging CDN services to evade detection.

Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk classification. Defenders should treat this domain as malicious, block it at the network level, and monitor for related indicators of compromise, including the associated IP (188.114.97.3) and registrar details. Further investigation into the redirect target and any linked infrastructure is recommended to assess the full scope of the campaign.