cyrexmods[.]icu

Analysis of cyrexmods.icu, registered on March 26 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, indicates an elevated‑risk phishing operation targeting gamers. The domain resolves to the Cloudflare address 172.67.166.111, which is hosted in Canada and is served behind Cloudflare's edge network. DNS is delegated to rocco.ns.cloudflare.com and tani.ns.cloudflare.com, and the site employed a Let's Encrypt E7 certificate, confirming the use of TLS but offering no credibility. Content analysis reveals a page title of "Krylenarpa - Cyrex Mods and Game Services by Krylenarpa !", aligning with the reported scam type of a gaming‑related phishing scheme.

Technical footprints include Bootstrap, Cloudflare Browser Insights, and HTTP/3, all typical of sites that rely on Cloudflare for performance and mitigation. VirusTotal scans show that 12 of 94 antivirus and URL‑reputation engines flagged the domain, suggesting malicious behavior. The domain appears on a single blocklist, PhishDestroy, which has already blocked access to the site. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

The site is currently offline, limiting immediate interaction but not precluding future reactivation. Uncertainties remain around the exact payload or credential‑harvesting mechanisms, as no detailed page content has been captured. Defenders should continue to monitor the IP 172.67.166.111 for any resurgence, enforce outbound traffic controls to block connections to this address, and update web‑gateway and DNS filtering policies to include cyrexmods.icu on deny lists. Given the confirmed phishing classification, organizations protecting gaming communities or accounts should treat any communications referencing "Krylenarpa" or similar mod services as suspicious and advise users to avoid providing credentials or payment information.