registration[.]iriys[.]xyz

This domain, registration.iriys.xyz, poses a direct threat as a brand impersonation scam targeting Binance users. The page title 'IRYS Airdrop' suggests an attempt to lure victims with fraudulent cryptocurrency giveaways, a common tactic to harvest credentials or deploy crypto-draining malware. Such schemes often exploit trust in legitimate brands to trick users into entering sensitive information or connecting wallets to malicious smart contracts, leading to unauthorized fund transfers or account takeovers. Analysis indicates the domain was registered on November 20, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3 and is flagged by 5 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist, further confirming its malicious intent. The infrastructure and timing align with typical phishing campaigns, where newly registered domains are rapidly deployed to evade detection before being taken offline. Users who visited registration.iriys.xyz should immediately revoke any wallet connections or credentials entered on the site. If cryptocurrency transactions were initiated, monitor blockchain records for unauthorized activity and consider reporting to relevant authorities. Reset passwords for any accounts accessed during the interaction, enable multi-factor authentication, and scan devices for malware. Given the domain's current offline status, remain vigilant for similar scams using slight variations of the domain name or branding.