cryptoslam-ir[.]io

On July 25, 2026 analysts observed that the domain cryptoslam-ir.io is currently offline but was previously associated with a high‑risk generic phishing campaign. The domain was registered through Dynadot LLC and its creation date is recorded as January 27, 2026. Infrastructure analysis shows the domain resolved to the IP address 104.21.27.163, which belongs to AS13335 operated by Cloudflare, Inc., located in the United States. DNS resolution used the Cloudflare authoritative nameservers ali.ns.cloudflare.com and eric.ns.cloudflare.com, indicating the use of Cloudflare’s CDN and security services.

The web application stack identified Vue.js, HTTP/3, Cloudflare Browser Insights, and HTTP Strict Transport Security (HSTS), suggesting a modern front‑end framework hosted behind Cloudflare’s edge. Reputation data from Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence in the domain’s legitimacy. VirusTotal scans reported that ten of ninety‑four security vendors flagged the domain as malicious, reinforcing the suspicion of malicious intent. Independent blocklist monitoring recorded the domain on three security blocklists, and it was explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating recognition by multiple anti‑phishing and crypto‑wallet security solutions.

The page title returned by the server was "Cryptoslam," but no further content analysis is available. Given the combination of a newly created domain, low trust score, multiple vendor detections, and blocklist inclusion, defenders should continue to monitor any residual DNS or IP activity linked to 104.21.27.163, enforce blocklist rules that already contain cryptoslam‑ir.io, and consider adding the domain to internal deny lists.