iryrs[.]xyz

This domain, iryrs.xyz, is identified as a credential harvesting phishing site targeting generic login credentials. Analysis indicates no direct association with a specific brand or drainer kit, though the infrastructure aligns with opportunistic phishing campaigns. The page title, 'Blank website. Blank site. Nothing to see here,' suggests an attempt to evade detection by appearing inactive while potentially hosting malicious content dynamically or redirecting victims to active phishing pages. Infrastructure analysis reveals the domain was registered on November 20, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.97.3 and has been flagged by 6 out of 95 security vendors on VirusTotal. The domain holds a Gridinsoft trust score of 0/100 and appears on one security blocklist. AlienVault OTX records the domain in a single threat intelligence pulse, further corroborating its malicious classification. Google Safe Browsing status is not explicitly noted, but the domain's detection metrics and blocklist presence confirm its elevated risk profile. The domain is currently offline, likely taken down due to detection or mitigation efforts. However, residual risk remains as threat actors may re-register or repurpose similar domains. Organizations are advised to monitor for related infrastructure, including the IP address 188.114.97.3 and domains registered through the same registrar. Proactive blocking of the domain and associated indicators is recommended to prevent potential exposure. Continuous threat intelligence monitoring should be maintained to detect resurgence or evolution of this campaign.