vaiyo[.]io

Analysis of vaiyo.io indicates a confirmed phishing domain with high-risk classification, currently active as of July 12, 2026. The domain was registered on May 15, 2026, through Immaterialism Limited and resolves to IP address 104.21.17.241. Infrastructure analysis reveals the use of Cloudflare (HTTP/3), WordPress, MySQL, and PHP, alongside a Google Trust Services SSL certificate. The domain is flagged by 3 of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and BLP-Malware. AlienVault OTX records the domain in 17 threat intelligence pulses, further corroborating its malicious status. The page title 'Just a moment...' suggests the site may be leveraging Cloudflare's interstitial page or a similar evasion technique, though the exact content and target of the phishing campaign remain unconfirmed. No specific brand, login form, or scam category is identified in the available data. Defenders should treat this domain as actively malicious and prioritize blocking both the domain and its resolving IP (104.21.17.241) at the network perimeter. Given the use of Cloudflare, additional scrutiny of related domains or IPs within the same infrastructure may be warranted to identify potential lateral movement or secondary attack vectors. The domain's registration age (under two months) aligns with common phishing lifecycle patterns, and its continued activity indicates ongoing operational use.