ibkrgroup[.]cc

The domain ibkrgroup.cc was registered through Dominet (HK) Limited on 21 February 2026 and is hosted on the IP address 45.207.194.25, which belongs to AS401696 cognetcloud INC in Hong Kong. The authoritative name servers are ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainnamedns.com and ns4.domainname, indicating use of a generic DNS provider. Service fingerprinting shows the web server runs Nginx with HTTP/3 enabled and HSTS enforced, but no TLS certificate is presented, implying the site was reachable only over plain HTTP before being taken offline. The page title was not captured, and the site currently returns no content, consistent with the reported offline status.

Three public phishing blocklists have listed ibkrgroup.cc, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans recorded 11 detections out of 93 security‑engine submissions, reinforcing the malicious classification. No additional intelligence such as a specific brand impersonated or a phishing kit identifier is available, leaving the exact lure unknown. Defenders should continue to block the domain at perimeter devices and update DNS‑based deny lists.

Monitoring of the hosting IP 45.207.194.25 for new activity is advisable, as the infrastructure could be repurposed for other campaigns. Because the site lacks an SSL certificate, any future activation would be visible on network traffic without encryption, enabling detection via proxy or IDS signatures. Analysts should also watch for new registrations using the same registrar and name‑server pattern, as these may indicate a recurring threat actor infrastructure.