ryochain[.]vip

Analysis of ryochain.vip indicates that the domain was registered on June 02, 2025 through NameSilo, LLC and is hosted on Cloudflare infrastructure (ASN 13335) with the IPv4 address 104.21.20.212 located in the United States. The domain resolves to the Cloudflare edge IP and uses the default Cloudflare nameservers brenda.ns.cloudflare.com and corey.ns.cloudflare.com. No TLS certificate was observed, implying the site was served over plain HTTP at the time of collection. The HTTP response returned a page whose title element contained the string “Ryochain”.

The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal scans show that seven out of ninety‑five AV engines flagged the domain as malicious, reinforcing the suspicion of phishing activity. The site has since been taken offline, and current network probes return no active service. The available evidence confirms that ryochain.vip is being used for a generic phishing campaign, though the specific lure or target brand has not been disclosed in the collected metadata.

The lack of a TLS certificate, the use of Cloudflare’s free DNS service, and the recent registration date are consistent with a short‑lived malicious infrastructure. Because the domain is no longer reachable, passive monitoring is limited to historical DNS and blocklist records. Defenders should continue to block the domain at perimeter filters, update any URL reputation lists with the observed indicators, and consider adding the IP address 104.21.20.212 to deny lists, acknowledging that the address is shared among many legitimate Cloudflare customers. Ongoing intelligence collection should focus on any future re‑registration of the domain, detection of similar page titles, and correlation with the seven vendor detections reported by VirusTotal to refine detection rules.