respinaresane[.]ir

Analysis of respinaresane.ir indicates an active phishing infrastructure targeting users with a crypto‑gambling lure. The domain resolves to the IPv4 address 185.128.136.169, which is registered to AS48715 Sefroyek Pardaz Engineering PJSC in Iran. The hosting provider supplies a Let’s Encrypt certificate (R13) and the site returns HTTP 200, confirming that the web server is reachable. The page title reported by the scanner is exactly “respinaresane.ir”, offering no additional context about the content.

The domain is listed on one public blocklist and appears in a single AlienVault OTX pulse, demonstrating that threat‑intel aggregators have flagged it. PhishDestroy also blocks the domain, reinforcing its classification as malicious. VirusTotal analysis shows that seven of ninety‑three scanning engines flagged the domain, further corroborating its suspicious nature. The authoritative nameservers are ns100.modirhost.com, ns101.modirhost.com, ns104.modirhost.com and ns105.modirhost.com, which are typical for domains hosted on the Modirhost platform.

No further details about the landing page, credential‑capture mechanisms, or additional infrastructure have been disclosed. Given the presence of multiple independent detections, security teams should add the domain to blocklists, monitor DNS queries for the listed IP and nameservers, and consider network‑level filtering of traffic to the host. Incident responders should also inspect any logs for connections to 185.128.136.169 and correlate them with user reports of crypto‑gambling scams. Continuous re‑evaluation is advised, as the infrastructure may evolve or expand.