io-en[.]help

Analysis as of July 22, 2026 shows that the domain io-en.help is currently offline but exhibits multiple indicators of malicious intent. The domain was registered on February 21, 2026 through Dynadot LLC and resolves to the IPv4 address 194.36.191.196, which is announced by AS60117 belonging to Host Sailor Ltd in the Netherlands. Both authoritative nameservers ns5.nl.hostsailor.com and ns6.nl.hostsailor.com resolve to the same host, confirming the hosting relationship. The site presented a page titled "NeuralBloom - Psychedelic Art Generator" and served content over LiteSpeed with HTTP/3 enabled, protected by a Let’s Encrypt R13 certificate, indicating a recent TLS deployment but offering no evidence of legitimate service.

Security telemetry lists the domain on three independent blocklists—PhishDestroy, MetaMask, and SEAL—and a Gridinsoft trust score of 0 out of 100, the lowest possible rating. VirusTotal analysis recorded three positive detections out of ninety‑three scanners, reinforcing the suspicion of abuse. An MX record exists with priority 0 pointing to the domain itself, a pattern often observed in phishing infrastructures that lack proper mail handling.

While the offline status limits immediate threat exposure, the combination of blocklist listings, low trust score, and detection by multiple anti‑malware engines suggests the domain was used for generic phishing campaigns. Defenders should continue to block the domain at perimeter controls, monitor for any resurgence of the IP address or associated hostnames, and consider adding the IP to reputation feeds. Further investigation of any residual DNS records or related subdomains is advised to identify potential spillover assets.