ircauniversal[.]com

PhishDestroy identifies ircauniversal.com as an active phishing domain engaged in generic phishing activity targeting users into submitting sensitive credentials. The domain was registered on July 31, 2025, and currently resolves to IP 92.113.23.147. No branded impersonation or drainer kit has been identified in this campaign at this time. The domain utilizes a Let's Encrypt SSL certificate, which may be used to enhance phishing legitimacy and bypass browser warnings. The exact seed hash e3b58b was used to trace and correlate this domain across monitoring systems.

This domain was flagged with a VirusTotal detection score of 0/95, indicating no antivirus or security vendor currently recognizes the malicious payload or landing page content. Hosting infrastructure is assigned to HOSTINGER operations, UAB, a known hosting provider. The domain’s creation date aligns with a recent registration pattern often observed in opportunistic phishing campaigns. At the time of analysis, the domain is not listed on Google Safe Browsing (GSB) and remains unblocked across major threat intelligence platforms. This suggests it is actively serving malicious content without prior exposure to security vendors.

ircauniversal.com is currently active and poses a high risk to users who may encounter it through phishing emails, social media links, or deceptive ads. The lack of vendor detection and absence from GSB increase exposure time and user risk. Immediate action includes blocking the domain and IP at the network perimeter and updating endpoint protection rules. Users should avoid interacting with this domain and report any encounters to their security teams. The threat remains under continuous monitoring, and further IOCs (Indicators of Compromise) may be released as intelligence evolves. Remaining risk is assessed as moderate due to limited vendor recognition and active distribution.