iragift[.]com

This domain is flagged for credential theft, a specific phishing threat targeting user login credentials and sensitive personal information. Analysis indicates the infrastructure was designed to harvest account details through deceptive login portals, likely mimicking legitimate services to trick victims into submitting credentials. The risk level is elevated due to the domain's active blocking by security vendors and its presence on at least one security blocklist. Infrastructure analysis reveals the following technical indicators: the domain iragift.com was registered through GoDaddy.com, LLC on April 18, 2026, and resolves to the IP address 172.67.151.91, located in California and associated with Cloudflare, Inc. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing domains to appear legitimate. VirusTotal reports 17 out of 95 security vendors flagging this domain as malicious, and the page title 'Site is created successfully!' suggests a recently deployed or placeholder phishing page. The domain is currently offline but was previously listed on at least one security blocklist. To mitigate the risk of credential theft, organizations and individuals should implement the following measures: immediately block the domain iragift.com and its associated IP address (172.67.151.91) at the network perimeter. Deploy endpoint protection to detect and prevent access to known phishing domains, and ensure browser-based security tools are configured to block or warn against credential harvesting sites. Users should be educated on recognizing phishing attempts, particularly those involving fake login pages, and encouraged to verify domain authenticity before entering credentials. Enable multi-factor authentication (MFA) on all critical accounts to reduce the impact of credential compromise. Monitor for unusual login attempts or account access patterns that may indicate stolen credentials.