yadgirandeh[.]ir

The domain yadgirandeh.ir was identified as a generic phishing site posing an elevated risk of credential theft or fraudulent activity. It did not impersonate a specific brand or deploy a known crypto drainer kit. As of the latest verification, yadgirandeh.ir has been taken offline, though prior activity classified it as unsafe for users.

Technical analysis of yadgirandeh.ir revealed limited detection, with 1 of 95 VirusTotal security vendors flagging the domain, including SOCRadar. The domain was registered through Cloudflare, Inc. and resolved to the IP address 172.67.166.153, hosted on Cloudflare's network (AS13335) in the US. It appeared on 1 security blocklist, specifically PhishDestroy, and used an SSL certificate issued by Let's Encrypt (E8). The observed page title was 'مدارس یادگیرنده - مدارس یادگیرنده مرآت', and technologies detected included Microsoft ASP.NET, HSTS, Google Analytics, and ArvanCloud. No creation date was available for the domain.

Users who may have interacted with yadgirandeh.ir should take immediate steps to secure their accounts. If credentials were entered, change passwords for affected services and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized activity and report any suspected fraud to relevant financial institutions or service providers. To assist in mitigation efforts, victims can report the phishing domain yadgirandeh.ir to their email provider, browser security teams, or platforms like Google Safe Browsing or PhishTank.