planet-iran[.]com

The domain planet-iran.com was registered on February 21, 2026 through NameCheap, Inc. and is currently resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and appears to be hosted in the United States. The domain is active, serves a 301 redirect, and is listed on a single security blocklist. Its DNS configuration uses the Cloudflare authoritative nameservers nola.ns.cloudflare.com and pedro.ns.cloudflare.com.

Infrastructure analysis shows the web server delivers content built with jQuery, references the IPinfo API, and loads assets from the cdnjs CDN, all over HTTP/3. The TLS certificate is issued by Google Trust Services under the WE1 profile, indicating a valid HTTPS handshake. VirusTotal scans have returned 2 positive detections out of 95 security vendors, and the Gridinsoft trust score is 0 out of 100, reinforcing a high‑risk classification. The domain is also flagged by the PhishDestroy blocklist.

While the observed indicators strongly suggest a credential‑harvesting operation, the precise payload and targeted brand are not disclosed in the available intelligence. The 301 redirect may lead to a downstream page that mimics legitimate services, but without a live capture of the final landing page the exact phishing vector remains uncertain. No additional malware families or command‑and‑control infrastructure have been linked to this host to date.

Defenders should add planet-iran.com and its resolving IP 188.114.96.3 to network‑level deny lists and ensure that any outbound connections to Cloudflare edge nodes hosting this domain are inspected. Monitoring for HTTP/3 traffic that includes jQuery or cdnjs requests to this host can help identify compromised clients. Organizations should also educate users about recent phishing attempts that reference Iranian‑related themes, and consider sinkholing the domain to disrupt future credential collection.