# cyrexmods.icu — MALICIOUS

> cyrexmods.icu distributes fake game mods as phishing bait. 9 out of 95 security tools flag this domain. Check the full report.

## Summary
PhishDestroy identifies cyrexmods.icu as a live phishing domain posing as a source for game mods. Visitors risk credential theft or malware downloads under the guise of popular titles.

This domain was flagged by 9 of 95 VirusTotal security vendors, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 24, 2026. The site uses a Let’s Encrypt SSL certificate and resolves to 172.67.166.111, a hosting provider linked to previous malicious campaigns.

If you visited cyrexmods.icu, avoid entering any login details or downloading files. Run a full antivirus scan immediately. Report the domain to your IT team or the platform where you discovered the link. Change passwords for accounts accessed after visiting, prioritizing gaming and payment-related credentials.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-24 17:11:29
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.166.111

## Detection Status
- VirusTotal: 9 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/10cbaa57-585a-4008-b9b0-cdba6666a56c
- PhishDestroy: https://phishdestroy.io/domain/cyrexmods.icu/
- LLM endpoint: https://phishdestroy.io/domain/cyrexmods.icu/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/cyrexmods.icu/
Last updated: 2026-03-26