byrrgis-waitlist[.]top

The domain byrrgis-waitlist.top was registered on 24 November 2025 through NiceNIC International Group Co., Limited. It resolves to the Cloudflare‑owned address 172.67.185.248, which is announced by AS13335 and geolocated to the United States. The site is served behind Cloudflare’s edge network, utilizes HTTP/3, and presents a valid Google Trust Services (WE1) TLS certificate, indicating that the attacker has leveraged a reputable CDN to hide the true origin of the malicious payload.

VirusTotal analysis shows that 6 out of 95 security vendors have flagged the domain, and the Gridinsoft trust score is 0 out of 100. Independent blocklists PhishDestroy and ScamSniffer have already listed the domain, and the infrastructure appears on two additional security blocklists. An HTTP 301 redirect is observed, and the page title returned by the server is “Byrrgis | The DeFi Trading Terminal That Finds Risk First”, suggesting a cryptocurrency‑focused lure.

The combination of a high‑risk rating, the explicit cryptocurrency scam type, and the presence of a deceptive DeFi‑related title indicates that the site is being used to harvest credentials or lure victims into financial fraud. While the exact content of the landing page has not been examined, the available metadata aligns with known patterns of crypto‑draining phishing campaigns. The active status and recent creation date imply ongoing operation, and the use of Cloudflare’s infrastructure complicates attribution.

Defenders should block byrrgis-waitlist.top at the DNS and firewall level, monitor traffic to the associated IP 172.67.185.248, and add the domain to internal blocklists. Continuous scanning of Cloudflare‑hosted assets for similar titles or redirects is advised, as the attacker can rapidly redeploy new domains under the same CDN. Incident response teams should also watch for credential‑stealing attempts targeting DeFi platforms that reference the Byrrgis branding.