w20io[.]com

Analysis of w20io.com indicates a high-risk credential-theft phishing domain that remains active as of July 25, 2026. The domain was registered on February 21, 2026, through Spaceship, Inc., a registrar frequently associated with newly spun-up phishing infrastructure. Current HTTP responses show a 302 redirect, suggesting the site is designed to funnel victims to a secondary malicious endpoint, though the final destination remains unconfirmed. The page title 'k20io' does not correspond to any known legitimate brand, and no specific brand impersonation has been verified at this stage. Infrastructure analysis reveals the domain resolves to IP address 45.150.34.89, hosted on AS205775 (NEON CORE NETWORK LLC) in the Netherlands, a network segment previously linked to phishing and bulletproof hosting.

Nameservers are set to launch1.spaceship.net and launch2.spaceship.net, reinforcing the connection to the registrar’s DNS infrastructure. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for threat actors due to its free, automated issuance process. Detection data shows the domain is flagged by one security vendor on the PhishDestroy blocklist, and Gridinsoft assigns a trust score of 0/100. While VirusTotal records a single detection out of 93 vendors, this does not indicate widespread consensus but does confirm at least one security provider has classified the domain as malicious. No Safe Browsing or Open Threat Exchange (OTX) alerts are currently documented in the available evidence.

Defenders should treat w20io.com as an active phishing threat. Network-level blocking of the IP (45.150.34.89) and domain is recommended, alongside monitoring for related subdomains or redirects. The 302 redirect behavior warrants further investigation to identify the final malicious payload or credential-harvesting page. Given the domain’s recent registration and low detection coverage, additional security vendors may flag it in the coming days.