utorrent[.]io

The domain utorrent.io is currently listed as an active high‑risk phishing infrastructure. DNS resolution points to the IPv4 address 188.114.96.3, a host that appears on three independent security blocklists. The same domain is also flagged by the PhishDestroy, MetaMask and SEAL blocklist services, indicating that multiple anti‑phishing engines have observed malicious activity originating from it.

VirusTotal analysis shows that 14 of 91 scanned security vendors have issued a detection for utorrent.io, reinforcing the consensus that the site is being used for credential‑stealing or related fraudulent operations. No public page title, SSL certificate details, or HTTP response codes have been disclosed in the available intelligence, so the exact content and delivery mechanisms remain unverified. The lack of additional telemetry such as registrar information or known malware kits limits the ability to attribute the infrastructure to a specific actor group.

Defenders should treat utorrent.io as a confirmed phishing site and enforce blocking at network perimeter, DNS filtering, and endpoint controls. Monitoring outbound connections to 188.114.96.3 and correlating any user‑initiated requests to this host with authentication attempts can help identify compromised accounts. Organizations are advised to update internal threat feeds with the blocklist identifiers from PhishDestroy, MetaMask and SEAL, and to continue periodic re‑scans to capture any changes in the domain’s behavior.