securitybounty[.]io

Analysis indicates that securitybounty.io is an active phishing domain registered on March 2, 2026, through Cloudflare, Inc. The domain currently resolves to 188.114.97.3 (AS13335, Cloudflare, Inc., US) and is served via Cloudflare nameservers (gabe.ns.cloudflare.com, heidi.ns.cloudflare.com). While the page title displays a 522 connection timeout error, the domain returns an HTTP 200 status, suggesting the server is operational but may be selectively blocking requests or undergoing maintenance to evade detection. Infrastructure review shows the domain uses Cloudflare hosting and HTTP/3, a common tactic to obscure origin servers and complicate takedown efforts. The SSL certificate is issued by Google Trust Services (WE1), which is not inherently malicious but is frequently leveraged by phishing operators to appear legitimate. Securitybounty.io is flagged by 6 security vendors on VirusTotal and appears on three blocklists, including PhishDestroy, MetaMask, and SEAL. AlienVault OTX records the domain in 23 threat intelligence pulses, further corroborating its malicious classification. The domain name suggests an attempt to impersonate a security bounty or bug reward program, though no specific brand target is confirmed in available data. Defenders should treat this domain as high-risk and implement blocking at the DNS or network level. Given its recent registration and active threat intelligence associations, monitoring for changes in hosting or SSL certificates is recommended. If the domain resumes serving content, further analysis of payloads or credential-harvesting mechanisms may be warranted.