registration[.]irys[.]zone

The domain registration.irys.zone was registered on November 13, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently reported as offline. The site resolves to the IP address 198.18.0.200, which belongs to the Cloudflare network (AS13335, United States). DNS resolution uses the Cloudflare authoritative name servers meilani.ns.cloudflare.com and zahir.ns.cloudflare.com, indicating that the infrastructure is fully hosted behind Cloudflare's edge services. The SSL certificate presented is issued by Google Trust Services under the WE1 label, confirming the use of a valid HTTPS certificate, but this does not mitigate the underlying threat.

Cloudflare-specific technologies detected include Browser Insights and HTTP/3, reinforcing the reliance on Cloudflare CDN. The page title observed before takedown was "Nur einen Moment…", a generic phrase offering no indication of the targeted brand or service. The domain carries a Gridinsoft trust score of 0 out of 100 and appears on a single security blocklist, having been blocked by PhishDestroy. VirusTotal analysis shows that two of ninety‑five AV engines flagged the domain, reflecting limited but notable detection.

No additional intelligence such as Safe Browsing, OTX, or brand‑specific markers is available, leaving the exact phishing lure uncertain. Defenders should continue to deny any internal traffic to the IP 198.18.0.200, enforce outbound DNS filtering for registration.irys.zone, and add the domain to existing blocklists if not already present. Monitoring of Cloudflare edge IP ranges for similar newly registered domains is recommended, as is periodic re‑scanning through multi‑vendor services to capture any evolving indicators. The combination of a brand‑less page title, low trust score, and presence on a phishing‑focused blocklist suggests an elevated risk despite the current offline status.