iriys[.]xyz

The domain iriys.xyz was registered on November 20, 2025 through NiceNIC International Group Co., Limited and is presently taken offline. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is served by Cloudflare nameservers nolan.ns.cloudflare.com and violet.ns.cloudflare.com, but no SSL certificate is present, indicating that HTTPS connections are not available. Threat intelligence indicates that the site is intended to impersonate the Pendle brand, as explicitly noted in the provided intelligence.

The page title returned from the live host was "This Page is for Sale," suggesting that the site was either a placeholder or a parked domain rather than an active credential‑harvesting portal. Detection data show that the domain appears on a single security blocklist and was flagged by nine of ninety‑five VirusTotal scanners, demonstrating modest but notable detection across multiple security vendors. Additionally, the anti‑phishing service PhishDestroy has listed the domain as blocked, and the Gridinsoft trust score is 0 out of 100, reinforcing the classification of the domain as malicious.

While the offline status limits immediate observation of malicious payloads or credential‑capture mechanisms, the combination of brand impersonation, low trust score, blocklist presence, and multi‑vendor detections warrants continued monitoring. Defensive operators should ensure that iriys.xyz is added to network deny lists, enforce DNS filtering, and watch for any re‑activation of the domain or the associated IP address. Correlation with other Cloudflare‑hosted assets used in recent Pendle‑related campaigns may reveal additional infrastructure that requires remediation.