irystoken[.]top

Analysis of the domain irystoken.top indicates it is a cryptocurrency scam impersonating the brand Across, with infrastructure evidence suggesting fraudulent intent. The domain was registered on October 1, 2025, through NameSilo, LLC, and is currently offline as of July 24, 2026. Infrastructure analysis reveals the domain resolves to the IP address 45.12.2.67, hosted in Ukraine under AS6698 (Virtual Systems LLC), a network frequently associated with malicious activity. The domain uses custom nameservers (ns1.irystoken.top, ns2.irystoken.top, ns1.juniperbot.top, ns2.juniperbot.top), which may facilitate rapid redeployment of scam infrastructure.

No SSL certificate is present, increasing the likelihood of interception or tampering. The domain appears on at least one security blocklist (PhishDestroy) and is flagged by 2 of 95 security vendors on VirusTotal, though the absence of broader detection does not confirm safety. The page title, 'IRYS Presale | The Datachain That Unlocks the Value of Data,' explicitly targets cryptocurrency investors, aligning with the scam classification provided in threat intelligence. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk status.

Defenders should treat this domain as confirmed malicious infrastructure. While the site is currently offline, the nameservers and hosting provider remain active, allowing potential reactivation. Organizations should block the domain, IP, and associated nameservers at the network level, monitor for related domains using the same registrar or hosting provider, and alert users to cryptocurrency presale scams impersonating legitimate projects. The exact content of the site is not yet analyzed, but the available evidence strongly supports its classification as a brand impersonation scam targeting the Across ecosystem.