iomas[.]xyz

The domain iomas.xyz was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently listed as offline. DNS resolution points to the Cloudflare edge address 172.67.173.79, hosted within AS13335 (Cloudflare, Inc.) in the United States. The authoritative nameservers are khloe.ns.cloudflare.com and melnicoff.ns.cloudflare.com, confirming Cloudflare as the chosen CDN and DNS provider. The site presents an HTTP/3 service layer but returns the page title "iomas.xyz | 525: SSL handshake failed," indicating that the TLS termination is intentionally disabled or misconfigured, which aligns with the reported offline status.

Security telemetry shows that five of ninety‑three VirusTotal scanners have flagged the domain as malicious, and the domain is presently blocked by the PhishDestroy feed and appears on one additional security blocklist. The SSL certificate presented is issued by Google Trust Services under the WE1 label, a common certificate for Cloudflare‑proxied sites, and does not provide any additional trust signals beyond confirming the use of standard Cloudflare TLS infrastructure.

Taken together, the registration timing, Cloudflare hosting, SSL configuration, and multiple vendor detections constitute strong evidence that iomas.xyz was deployed for phishing purposes before being taken offline. While the actual page content has not been captured, the presence of a 525 error page and the existing blocklist entries suggest the domain was actively used in a malicious campaign. Defenders should immediately add iomas.xyz and its resolving IP address 172.67.173.79 to network deny lists, monitor for any DNS re‑registration or changes to the Cloudflare nameservers, and watch for similarly structured, newly created domains that leverage Cloudflare’s CDN for rapid deployment.