fairbox[.]io

On 23 July 2026 the domain fairbox.io was assessed as an elevated‑risk generic phishing infrastructure. The registrant created the domain on 21 February 2026 and it currently resolves to the address 188.114.97.3, which belongs to the Cloudflare network (ASN 13335) and is geolocated in the United States. The site presents an HTTP 521 response indicating that the web server is down; the page title returned by the server is "fairbox.io | 521: Web server is down". An SSL certificate identified as "WE1" is present, confirming that TLS termination is being performed at the CDN edge.

Reputation checks show that fairbox.io appears on two independent security blocklists and is explicitly listed by PhishDestroy and ScamSniffer. The Gridinsoft trust engine assigns a score of 0 out of 100, reflecting a complete lack of confidence. VirusTotal analysis reports that 14 of 93 scanned security vendors flagged the domain, reinforcing the suspicion of malicious use. The domain’s current operational status is offline, suggesting that the hosting has been taken down, but the historical evidence points to a short‑lived phishing campaign.

The available evidence confirms the presence of phishing‑related infrastructure, yet there is no publicly available information about the specific payload, targeted brand, or victim interaction beyond the generic classification. Consequently, defenders should continue to block the domain at network borders, update URL filtering lists with the observed blocklist entries, and monitor for any resurgence of the same IP address or certificate fingerprint. Ongoing observation of the Cloudflare edge IPs for similar patterns is also recommended, as the hosting provider can be reused for future campaigns.