antiphishing[.]io

This domain, antiphishing.io, is flagged for elevated-risk generic phishing activity involving brand impersonation of security services. Analysis indicates the infrastructure is designed to deceive users into believing they are interacting with a legitimate anti-phishing platform, potentially harvesting credentials or distributing malicious payloads under false pretenses. The threat type aligns with patterns observed in fraudulent security tool impersonations, where attackers exploit trust in cybersecurity branding to bypass user skepticism. Infrastructure analysis reveals the domain was registered on February 24, 2026, through Squarespace Domains LLC, a registrar frequently observed in phishing campaigns due to its accessibility and bulk registration capabilities. The domain resolves to IP address 198.49.23.144, hosted on AS53831 (Squarespace, Inc.) in the United States. At the time of assessment, 16 out of 95 security vendors on VirusTotal detected the domain as malicious, while it appears on one active security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains due to its free and automated issuance process. The page title, 'Coming Soon,' suggests the campaign may be in a preparatory or testing phase, with full deployment pending. Mitigation steps for this threat type include immediate domain blacklisting at the network perimeter and endpoint levels, particularly for organizations in cybersecurity or IT sectors where brand impersonation may yield higher success rates. Security teams should monitor for DNS queries to 198.49.23.144 and correlate with Squarespace-hosted domains registered after February 2026, as this may indicate related infrastructure. User awareness training should emphasize verification of security service domains, particularly those using terms like 'anti-phishing' or 'security' in their naming conventions. Certificate transparency logs should be reviewed for additional Let's Encrypt certificates issued to similar domains, as attackers often reuse certificate authorities for consistency in their campaigns.