play[.]irys[.]name

play.irys.name is currently active and has been classified as a high‑risk generic phishing site. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It is listed on at least one public blocklist and has been explicitly blocked by PhishDestroy. Network resolution points to the IP address 104.21.36.139, which belongs to Cloudflare, Inc. (AS13335) and is hosted in the United States. The domain uses Cloudflare’s DNS service, as indicated by the authoritative nameservers earl.ns.cloudflare.com and melody.ns.cloudflare.com, and supports HTTP/3. TLS termination is provided by a Google Trust Services / WE1 certificate, and the server returns HTTP 403 for the request that returned the page title “Just a moment…”. The site’s technology stack therefore relies on Cloudflare’s edge network for both DNS and CDN functions. Threat intelligence feeds show that 1 of 95 VirusTotal scanners flagged the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification. The combination of a recent registration date, a generic “Just a moment…” page title, and a 403 response suggests the site is likely used to host credential‑harvesting or redirect payloads, consistent with the generic_phishing label. However, without direct analysis of the page content, the exact phishing lure or targeted brand cannot be confirmed. Defenders should block DNS resolution for play.irys.name at the network perimeter and enforce HTTP/HTTPS filtering to drop any traffic to the IP 104.21.36.139 when associated with this host header. Monitoring of outbound connections to Cloudflare edge nodes for anomalous patterns is advisable, as is the inclusion of the domain in internal blocklists. Continuous re‑evaluation is recommended, given the active status and high risk rating.