app-irys[.]xyz

Analysis of app-irys.xyz indicates that the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The authoritative name servers are john.ns.cloudflare.com and uma.ns.cloudflare.com, pointing to Cloudflare's network (ASN 13335). DNS resolution returns the IP address 172.67.199.40, which is owned by Cloudflare, Inc., and geolocated to the United States. No TLS certificate is presented; the site serves HTTP only, and the page title returned is “Just a moment…”, suggesting the site is either a placeholder or a waiting page.

The domain is currently offline and has been taken down, with the takedown confirmed by the PhishDestroy blocklist. Reputation services show a Gridinsoft trust score of 0 out of 100, indicating extreme suspicion. VirusTotal has recorded six positive detections out of ninety‑three scanned vendors, and the domain appears on a single external security blocklist. The limited detection footprint, combined with the lack of SSL, the recent registration date, and the low trust score, align with the classification of a generic phishing campaign.

However, the absence of visible payload, target brand, or malicious URL patterns prevents a more precise attribution of the phishing vector. Defenders should continue to block the domain at perimeter filters, monitor for any re‑hosting attempts on other IP ranges, and update internal threat intel feeds with the observed indicators: the domain name, its Cloudflare IP, the name‑server pair, and the observed page title. Ongoing observation is recommended in case the infrastructure is resurrected or the domain is re‑registered under a different registrar.