circle[.]charry[.]shop

The domain circle.charry.shop is currently active and has been identified as a generic phishing infrastructure. DNS queries return the IP address 172.67.159.154; no authoritative name servers were returned in the lookup, indicating a possible misconfiguration or use of a CDN that obscures the underlying resolver. The domain was submitted to VirusTotal where 91 anti‑malware engines examined the site and none reported a detection, which does not constitute a safety guarantee.

Independent security feeds have added the domain to three blocklists, and it is explicitly listed as blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple mitigation platforms recognize it as malicious. The lack of public registrar information and the absence of a page title or brand attribution in the available intelligence leave the exact phishing lure undefined. Analysts therefore cannot determine the targeted brand or the visual content of the landing page.

Given the active status, the presence on multiple blocklists, and the unresolved name‑server configuration, defenders should continue to deny network traffic to both the domain and its resolved IP, monitor DNS queries for related sub‑domains, and consider adding the IP to threat‑intel feeds. Ongoing observation of any changes in detection status or additional contextual data, such as SSL certificate details or page content, is recommended to refine response actions.