irriscape[.]com[.]au

This domain, irriscape.com.au, is flagged as a credential theft phishing site designed to impersonate a legitimate Australian landscaping and irrigation service provider. Analysis indicates the site mimics the branding and page structure of a genuine business, likely to harvest login credentials or financial details from unsuspecting users in the agricultural or landscaping sectors. No evidence of crypto drainer kits or payment diversion mechanisms was observed, but the site's structure aligns with credential harvesting tactics commonly deployed in business impersonation campaigns. Infrastructure analysis reveals the domain was registered through Web Address Registration Pty Ltd and resolves to the IP address 103.226.222.98, hosted on AS38719 (Dreamscape Networks Limited) in Australia. The domain is currently detected by 18 out of 95 security vendors on VirusTotal, with active listings on two security blocklists. The SSL certificate is issued by Let's Encrypt (R13), a common practice among both legitimate and malicious sites to evade browser warnings. No Google Safe Browsing (GSB) detections were reported at the time of analysis, though this may reflect a lag in propagation rather than a clean status. The domain has since been taken offline, likely in response to detection by PhishDestroy and PhishingDB. However, residual risk remains due to the potential for credential reuse by victims who may have interacted with the site prior to its removal. Organizations in the landscaping, irrigation, or agricultural sectors are advised to monitor for unauthorized access attempts using credentials that may have been exposed. Users who visited the site should rotate passwords for any accounts accessed during the exposure window and enable multi-factor authentication where available. The registrar and hosting provider have not publicly disclosed remediation actions, leaving open the possibility of infrastructure reuse for future campaigns.