iridia[.]me

The domain iridia.me has been confirmed as an active crypto drainer phishing site targeting cryptocurrency wallet credentials and funds. Analysis indicates the infrastructure is designed to mimic legitimate wallet interfaces, tricking users into authorizing malicious transactions that result in unauthorized fund transfers. The domain remains operational as of the latest verification, posing an immediate threat to individuals interacting with decentralized finance platforms. Infrastructure analysis reveals the domain was registered on April 08, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.96.128, which hosts additional suspicious endpoints. Detection metrics show the domain is flagged by 17 of 95 security vendors on VirusTotal, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on three security blocklists, including PhishDestroy, OISD, and Hagezi, further corroborating its malicious classification. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. Current risk assessment categorizes iridia.me as high severity due to its active exploitation of cryptocurrency users and the irreversible nature of fund theft. Users are strongly advised to block the domain at the network level and avoid interacting with any content hosted on it. Cryptocurrency wallet holders should revoke any suspicious transaction approvals linked to this domain and monitor their accounts for unauthorized activity. Organizations are recommended to update their threat intelligence feeds to include this domain and its associated IP address, ensuring proactive detection and prevention of related phishing attempts.