lounge[.]vuahox[.]com

Analysis of lounge.vuahox.com indicates a high-risk phishing domain registered on July 23, 2026, through Fewmoretaps OU d/b/a Trustname.com. As of August 7, 2026, the domain remains active and resolves to IP address 104.21.17.59, hosted on Cloudflare nameservers emerson.ns.cloudflare.com and thea.ns.cloudflare.com. VirusTotal reports 10 of 91 security vendors flagging this domain as malicious, and it appears on at least one security blocklist, specifically PhishDestroy.

No additional brand targeting, phishing kit, or page content details are currently available, so the exact nature of the impersonated login portal is unconfirmed. Defenders should note that the domain's recent registration and use of Cloudflare infrastructure are consistent with phishing campaigns aiming to evade detection. The IP address 104.21.17.59 may host other malicious domains, warranting further investigation into associated infrastructure.

Given the domain's active status and detection by multiple security vendors, immediate blocking at the network and endpoint levels is recommended. If internal telemetry indicates any user interaction with this domain, initiate incident response procedures to assess potential credential compromise or data exposure. Monitor for additional domains registered under the same registrar or resolving to the same IP, as threat actors often reuse infrastructure across campaigns.