registration-irys[.]app

registration-irys.app was registered on 21 November 2025 through NiceNIC International Group Co., Limited. The domain resolves to the IPv4 address 95.214.235.117, which is allocated to AS30860 Virtual Systems LLC and geolocated to Ukraine. Authoritative nameservers are ns13.v-sys.org and ns14.v-sys.org. No TLS certificate is presented, and the site currently returns an “Account Suspended” page title, indicating that the hosting service has taken the content offline.

Historical analysis classifies the domain as an account‑takeover phishing site. It appears on two independent blocklists, PhishDestroy and ScamSniffer, and is listed on a total of two security blocklists. VirusTotal scans recorded 13 detections out of 95 participating scanners, confirming malicious intent. The lack of SSL, the use of a Ukrainian hosting provider, and the recent registration date align with infrastructure patterns observed in other account‑takeover campaigns.

Defenders should add the domain and its resolving IP address to deny‑list rules at perimeter and DNS filtering layers, monitor for any resurgence of the site, and enforce strict credential‑reuse policies for affected services. Continuous threat‑intel feeds should be queried for any new indicators tied to AS30860 or the v‑sys.org nameserver pair, as adversaries often reuse this infrastructure. Organizations that have previously experienced account‑takeover attempts should verify that no credentials have been compromised and consider prompting users for additional authentication when accessing services that may be targeted by similar phishing campaigns.