irondns[.]is

This domain, irondns.is, is currently under investigation for credential-theft phishing activity. As of August 06, 2026, the domain resolves to the IP address 91.220.101.188 and appears on a single security blocklist, having been flagged by PhishDestroy. No additional detection vendors have currently identified the domain as malicious, though this absence does not confirm its safety.

Infrastructure analysis reveals no further details regarding the hosting provider, autonomous system, or geolocation associated with the IP. The domain's registration and ownership details remain unconfirmed, and there is no available information on SSL certificate validity, HTTP response status, or page content. Defenders should treat this domain as potentially hostile, particularly if observed in network logs, email headers, or endpoint telemetry.

Immediate action should include blocking the domain and its resolving IP at the perimeter, monitoring for internal connections to 91.220.101.188, and reviewing any associated email or web traffic for signs of credential harvesting or lateral movement. Given the limited detection coverage, security teams are advised to conduct retrospective analysis of historical logs for prior connections and to submit the domain to additional threat intelligence platforms for further scrutiny. No brand or specific phishing kit has been confirmed at this stage, and the exact nature of the credential-theft mechanism remains unanalyzed.