irajat[.]in

Analysis indicates that the domain irajat.in is actively used for a generic phishing campaign. The domain resolves to 188.114.97.3, a Cloudflare edge node located in Canada and is served by Cloudflare’s DNS infrastructure (chip.ns.cloudflare.com, isla.ns.cloudflare.com). HTTP requests receive a 302 redirect, and the page title returned is “Notion”, suggesting the site may be attempting to impersonate that service, although the content has not been examined. Registration data shows the domain was purchased through GoDaddy, and the SSL certificate presented is issued by Google Trust Services under the WE1 designation, which is typical for Cloudflare‑protected sites. VirusTotal scans have flagged the domain by 2 of 91 security vendors, and the domain appears on three independent blocklists. It is also listed as blocked by PhishDestroy, MetaMask, and SEAL. MX records point to Cloudflare’s mail routing (route2.mx.cloudflare.net) with a priority of 28; a second MX entry is truncated in the provided data. No additional infrastructure such as command‑and‑control servers or payloads has been observed. The evidence confirms that irajat.in is currently active and being leveraged for phishing, but the specific tactics, target audience, and content of the phishing page remain unknown. Defenders should block DNS resolution to the domain, add the IP address 188.114.97.3 to network deny lists, and monitor for any traffic that matches the observed 302 redirect pattern. Email filters should reject messages referencing the domain, especially those attempting to use the “Notion” brand, and threat‑intel feeds should be updated to include the listed blocklist identifiers.