iryis[.]xyz

On 21 February 2026 the domain iryis.xyz was registered through NiceNIC International Group Co., Limited. The domain resolves to 104.21.78.165, an address owned by AS13335 Cloudflare, Inc. in the United States and is served behind Cloudflare’s edge network, as indicated by the presence of Cloudflare Browser Insights, HTTP/3 support, and the authoritative nameservers glen.ns.cloudflare.com and poppy.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 identifier, confirming a valid HTTPS endpoint at the time of analysis.

A single page was retrieved before the service was taken offline; the HTTP response returned the title “Just a moment…”, which is consistent with a typical interstitial used by phishing kits. The kit has been identified as an “Airdrop Scam” phishing package, a pattern commonly employed to lure victims with promises of token airdrops. The domain appears on one public blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal scans show that four of ninety‑three security vendors flagged the domain, reinforcing the elevated risk rating.

Evidence from the current data set does not reveal the exact landing‑page content, targeted brand, or victim interaction flow, leaving those aspects uncertain. However, the combination of a recent registration, Cloudflare‑based hosting, a legitimate‑looking Google‑issued certificate, and detection by multiple security vendors indicates a purposeful malicious deployment.

Defenders should add iryis.xyz to DNS‑based deny lists and web‑filtering rules, monitor the associated IP address and Cloudflare name‑server pairs for re‑use, and watch for any future certificate re‑issuance that could signal a re‑activation. Continuous correlation with phishing‑kit signatures and blocklist updates is recommended to catch any re‑emergence of the Airdrop Scam infrastructure.