cyrexmodes[.]icu

PhishDestroy identifies cyrexmodes.icu as an active generic phishing domain posing an elevated risk to users. This domain is engineered to impersonate trusted services and deceive victims into disclosing sensitive information such as login credentials or financial data. The threat is classified as generic phishing due to its broad, non-targeted approach aimed at capturing any user who interacts with the fraudulent site. This domain was flagged by 5 out of 95 security vendors on VirusTotal as of the investigation seed 70d7ef. It resolves to IP 188.114.97.3 and was created on March 26, 2026. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and secured with a Let’s Encrypt SSL certificate, which increases its appearance of legitimacy. The low detection ratio indicates limited but present awareness among security tools, suggesting the campaign may be recent or rapidly evolving. Users encountering cyrexmodes.icu should immediately cease interaction and avoid entering any credentials or personal information. Organizations are advised to block both the domain and the associated IP address at the network perimeter. Users should report the domain to their email providers, browsers, and threat intelligence platforms. Given the domain’s recent creation and low detection rate, heightened vigilance is critical to prevent credential theft and potential downstream attacks.